CVE-2026-33633

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33633", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-23T14:24:11.618Z", "datePublished": "2026-05-19T17:36:07.762Z", "dateUpdated": "2026-05-20T03:55:46.409Z"}, "containers": {"cna": {"title": "Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler", "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "lang": "en", "description": "CWE-122: Heap-based Buffer Overflow", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-j68c-v8x4-269g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-j68c-v8x4-269g"}, {"name": "https://github.com/kovidgoyal/kitty/commit/e9661f0f3afb4e4dbffa509adfb3df3c9780ad34", "tags": ["x_refsource_MISC"], "url": "https://github.com/kovidgoyal/kitty/commit/e9661f0f3afb4e4dbffa509adfb3df3c9780ad34"}], "affected": [{"vendor": "kovidgoyal", "product": "kitty", "versions": [{"version": "< 0.47.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-19T17:36:07.762Z"}, "descriptions": [{"lang": "en", "value": "Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0."}], "source": {"advisory": "GHSA-j68c-v8x4-269g", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-j68c-v8x4-269g", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-19T00:00:00+00:00", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-33633"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-20T03:55:46.409Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33633", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-19T17:56:38.354586Z"}}}], "references": [{"url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-j68c-v8x4-269g", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-19T17:56:33.521Z"}}], "cna": {"title": "Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler", "source": {"advisory": "GHSA-j68c-v8x4-269g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "kovidgoyal", "product": "kitty", "versions": [{"status": "affected", "version": "< 0.47.0"}]}], "references": [{"url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-j68c-v8x4-269g", "name": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-j68c-v8x4-269g", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/kovidgoyal/kitty/commit/e9661f0f3afb4e4dbffa509adfb3df3c9780ad34", "name": "https://github.com/kovidgoyal/kitty/commit/e9661f0f3afb4e4dbffa509adfb3df3c9780ad34", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-19T17:36:07.762Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33633", "state": "PUBLISHED", "dateUpdated": "2026-05-20T03:55:46.409Z", "dateReserved": "2026-03-23T14:24:11.618Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-19T17:36:07.762Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kitty", "vendor": "kovidgoyal", "versions": [{"status": "affected", "version": "< 0.47.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:*", "matchCriteriaId": "F5F5CC5E-DE6C-4B63-BE58-D083F148C37B", "versionEndExcluding": "0.47.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0."}, {"lang": "es", "value": "Kitty es un terminal multiplataforma basado en GPU. Las versiones 0.46.2 e inferiores contienen un desbordamiento de b\u00fafer de mont\u00f3n en load_image_data() que permite a cualquier proceso que pueda escribir en la entrada est\u00e1ndar (stdin) del terminal bloquear Kitty inmediatamente. La vulnerabilidad se activa mediante un \u00fanico comando del protocolo gr\u00e1fico APC con una declaraci\u00f3n de formato PNG (f=100) cuya carga \u00fatil excede el doble de la capacidad inicial del b\u00fafer. El desbordamiento es controlado por el atacante tanto en longitud como en contenido, causando DoS y potencialmente una escalada a RCE. Este problema ha sido solucionado en la versi\u00f3n 0.47.0."}], "id": "CVE-2026-33633", "lastModified": "2026-07-24T12:10:00.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33633", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-19T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-05-19T18:16:21.343", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/kovidgoyal/kitty/commit/e9661f0f3afb4e4dbffa509adfb3df3c9780ad34"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-j68c-v8x4-269g"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/kovidgoyal/kitty/security/advisories/GHSA-j68c-v8x4-269g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.47.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "kitty", "source": "cna", "vendor": "kovidgoyal"}, "product": "kitty", "vendor": "kovidgoyal"}], "created": "2026-05-19T18:30:11.020886+00:00", "updated": "2026-05-19T20:30:13.402491+00:00", "vendors": ["kovidgoyal", "kovidgoyal$PRODUCT$kitty"]}