Heap Buffer Overflow in Kitty Terminal Affects Multiple Users

CVE-2026-33633

What is CVE-2026-33633?

Kitty, a cross-platform GPU based terminal, is affected by a heap buffer overflow in its load_image_data() function. This flaw allows any process that can write to the terminal's stdin to cause an immediate crash by issuing a single APC graphics protocol command. This vulnerability, triggered by a PNG format payload that exceeds the initial buffer capacity, can lead to denial of service (DoS) and may pose risks of remote code execution (RCE). Users are urged to upgrade to version 0.47.0 or later, where this issue has been addressed.

References