Out-of-Bounds Write Vulnerability in Kitty Terminal by Kovid Goyal

CVE-2026-80431

What is CVE-2026-80431?

The vulnerability involves an out-of-bounds write in the text sizing protocol of Kitty terminal due to improper handling of grapheme clusters. In versions prior to 0.49.0, the function screen_handle_multicell_command() does not perform adequate capacity checks when writing characters to a fixed-size buffer. This oversight can cause data to be written past the end of the buffer, leading to potential process termination. The issue occurs during sequence processing that can flush the buffer and may cause significant disruptions in terminal operations, affecting all windows, tabs, and child processes.

References