Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔴 Kitty, Heap Buffer Overflow, #CVE-2026-33633 (Critical) https://dailycve.com/kitty-heap-buffer-overflow-cve-2026-33633-critical/
Post summary
A critical heap buffer overflow flaw (CVE‑2026‑33633) in Kitty is announced, detailing the vulnerability type but lacking evidence of exploitation, PoC, or mitigation.
CVE-2026-33633 Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to… https://www.cve.org/CVERecord?id=CVE-2026-33633
Post summary
CVE-2026-33633 describes a heap buffer overflow in Kitty versions 0.46.2 and earlier, with no PoC, exploit, patch, or active exploitation details provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | kovidgoyal | kitty | - | - | - |