DEBIAN-CVE-2026-33633
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-33633
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33633.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-33633
- Upstream
- Published
- 2026-05-19T18:16:21Z
- Modified
- 2026-09-14T17:03:08Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0.
- References
Affected packages
Debian:12 / kitty
Package
- Name
- kitty
- Purl
- pkg:deb/debian/kitty?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
0.*
0.26.5-5
0.30.1-1
0.31.0-1
0.31.0-2
0.31.0-3
0.31.0-4
0.32.0-1
0.32.1-1
0.32.2-1
0.33.0-2
0.33.1-1
0.34.1-1
0.35.1-1
0.35.2-1
0.36.1-1
0.36.4-1
0.36.4-2
0.36.4-3
0.37.0-1
0.38.1-1
0.39.0-1
0.39.1-1
0.40.0-1
0.41.1-1
0.41.1-2
0.42.1-1
0.42.2-1
0.43.1-1
0.44.0-1
0.45.0-1
0.45.0-2
0.46.1-1
0.46.2-1
0.47.0-1
0.47.0-2
0.47.0-3
0.47.3-1
0.47.4-1
0.48.2-1
Debian:13 / kitty
Package
- Name
- kitty
- Purl
- pkg:deb/debian/kitty?arch=source&distro=trixie
Debian:14 / kitty
Package
- Name
- kitty
- Purl
- pkg:deb/debian/kitty?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed0.47.0-1