# CVE-2026-80431: kitty out-of-bounds write in text sizing protocol

Source: https://junglewise.ai/threats/cve-2026-80431-out-of-bounds-write-in-the-natural-width-branch-of-the-text  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-80431 · Severity: info · Published 2026-09-25

kitty is a terminal emulator used to display text and interactive applications. A malicious program can craft escape codes that cause kitty to write data beyond allocated memory buffers, crashing the entire terminal and closing all running sessions and windows.

Vendors: [Kovidgoyal](https://junglewise.ai/threats/vendors/kovidgoyal).

## Quick answers

**Is CVE-2026-80431 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80431 being exploited in the wild.

**How severe is CVE-2026-80431?** Informational severity, published 25 September 2026.

**Which products and versions are affected?** Kovidgoyal Kitty 0.40.0 before 0.49.0.

**Is there a fix for CVE-2026-80431?** A patch was published on 2026-09-21: Fixed in version 0.49.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-80431 attacked?** It is attacked over the network or with local access, in a network appliance.

**Am I affected by CVE-2026-80431?** Check whether you run Kovidgoyal Kitty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability exists in the natural width branch of kitty's text sizing protocol (OSC 66 escape code handling). The screen_handle_multicell_command() function in kitty/screen.c appends grapheme cluster codepoints without bounds checking to a fixed four-element array on the stack; a cluster longer than four codepoints overflows the buffer. If a flush occurs first, the buffer migrates to the heap, but the write still exceeds the heap allocation. Exploitation requires writing specially crafted escape codes to the terminal.

## Affected products

- kovidgoyal kitty 0.40.0 before 0.49.0

## Timeline

- 2026-09-25: disclosed
- 2026-09-21: patched: Fixed in version 0.49.0

## References

- [https://github.com/kovidgoyal/kitty/commit/7d2fbaadcc2b1eeeef89bd875ec622b42362574b](https://github.com/kovidgoyal/kitty/commit/7d2fbaadcc2b1eeeef89bd875ec622b42362574b)
- [https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0](https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0)

## Related threats

- [kitty drag and drop information disclosure](https://junglewise.ai/threats/cve-2026-80432-missing-authorization-in-the-drop-handling-path-of-the-drag-and)