Executive brief
Kitty is a popular cross-platform terminal emulator that uses the computer's graphics processor to render text and images. A vulnerability in how it handles image composition commands allows an attacker to crash the application or potentially gain unauthorized access to memory. This can be triggered simply by displaying malicious content in the terminal, such as viewing a crafted file, connecting to a compromised server via SSH, or piping data from a website.
Technical details
An integer overflow vulnerability exists in the `handle_compose_command()` function within `kitty/graphics.c`. The function performs bounds validation on `x_offset` and `y_offset` using unsigned 32-bit arithmetic. By supplying crafted values (e.g., 0xFFFFFFE0), an attacker can cause the addition of the offset and image width to wrap around, bypassing the bounds check. These unchecked offsets are subsequently used in `compose_rectangles()` for pointer arithmetic, leading to out-of-bounds heap access approximately 4GB beyond the intended buffer. This can result in a denial of service (crash), information disclosure via OOB read, or heap corruption. The attack requires no user interaction and can be delivered via any mechanism that writes escape sequences to the terminal. The issue is fixed in version 0.47.0 (and 0.46.3 according to some advisory metadata).
Affected products
- Kovid Goyal Kitty <= 0.46.2
Timeline
- 2026-05-19: disclosed
- 2026-05-19: advisory
- 2026-05-19: patched