Quick answers
- Is CVE-2026-33633 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-33633 being exploited in the wild.
- How severe is CVE-2026-33633?
- High severity, with a CVSS score of 7.5, published 19 May 2026.
- Which products and versions are affected?
- kovidgoyal Kitty <= 0.46.2.
- Is there a fix for CVE-2026-33633?
- A patch was published on 2026-05-19: Fixed in version 0.47.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-33633 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-33633?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap-based buffer overflow exists in the `load_image_data()` function within `kitty/graphics.c`. The vulnerability is triggered when processing an APC graphics protocol command using the PNG format (f=100). While the code attempts to resize the buffer by doubling its capacity when the payload exceeds the current size, it fails to verify if the new doubled capacity is sufficient before performing a `memcpy`. An attacker can exploit this by providing a payload that is more than twice the initial buffer size, leading to an out-of-bounds write. This can be triggered by any process capable of writing to the terminal's stdin. The issue is fixed in version 0.47.0 (and backported in some contexts to 0.46.3).
Affected products
- kovidgoyal Kitty <= 0.46.2
Timeline
- 2026-03-21: other: Version 0.46.2 released
- 2026-05-19: disclosed
- 2026-05-19: advisory
- 2026-05-19: patched: Fixed in version 0.47.0