{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-80431",
"assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
"state": "PUBLISHED",
"assignerShortName": "Secur0",
"dateReserved": "2026-08-26T10:49:01.410Z",
"datePublished": "2026-09-25T13:23:51.590Z",
"dateUpdated": "2026-09-25T15:07:45.536Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
"shortName": "Secur0",
"dateUpdated": "2026-09-25T13:23:51.590Z"
},
"title": "Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process",
"datePublic": "2026-09-21T04:01:00.000Z",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"affected": [
{
"vendor": "Kovid Goyal",
"product": "kitty",
"repo": "https://github.com/kovidgoyal/kitty",
"programFiles": [
"kitty/screen.c"
],
"versions": [
{
"status": "affected",
"version": "0.40.0",
"lessThan": "0.49.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"cpeApplicability": [
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0.40.0",
"versionEndExcluding": "0.49.0"
}
]
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screen_handle_multicell_command() in kitty/screen.c appends each codepoint of a grapheme cluster with lc.chars[lc.count++] = ch without any capacity check, while lc is declared by the RAII_ListOfChars macro as a four-element char_type array in the function's stack frame, so an OSC 66 escape code whose payload carries a grapheme cluster longer than four codepoints writes beyond that buffer, one 32-bit value per additional codepoint, in the order the codepoints appear. Where the cluster is preceded in the same payload by a sequence that causes an intermediate flush, the buffer is first migrated to the heap by ensure_space_for_chars() and the write occurs past the heap allocation instead. This results in termination of the kitty process and therefore of all its windows, tabs and child processes.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screen_handle_multicell_command() in kitty/screen.c appends each codepoint of a grapheme cluster with lc.chars[lc.count++] = ch without any capacity check, while lc is declared by the RAII_ListOfChars macro as a four-element char_type array in the function's stack frame, so an OSC 66 escape code whose payload carries a grapheme cluster longer than four codepoints writes beyond that buffer, one 32-bit value per additional codepoint, in the order the codepoints appear. Where the cluster is preceded in the same payload by a sequence that causes an intermediate flush, the buffer is first migrated to the heap by ensure_space_for_chars() and the write occurs past the heap allocation instead. This results in termination of the kitty process and therefore of all its windows, tabs and child processes."
}
]
}
],
"tags": [
"x_open-source"
],
"references": [
{
"url": "https://github.com/kovidgoyal/kitty/commit/7d2fbaadcc2b1eeeef89bd875ec622b42362574b",
"tags": [
"patch"
]
},
{
"url": "https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0",
"tags": [
"release-notes"
]
},
{
"url": "https://secur0.com/en/cna/cve-list/cve-2026-80431-kitty-text-sizing-out-of-bounds-write",
"tags": [
"third-party-advisory",
"technical-description"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 6.8,
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
}
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to kitty 0.49.0 or later.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Upgrade to kitty 0.49.0 or later."
}
]
}
],
"credits": [
{
"lang": "en",
"value": "C4sh3R",
"type": "finder"
},
{
"lang": "en",
"value": "Cristian Fernández Cornejo",
"type": "analyst"
},
{
"lang": "en",
"value": "Xoán M. Otero Jorge",
"type": "analyst"
},
{
"lang": "en",
"value": "Secur0 CNA",
"type": "coordinator"
},
{
"lang": "en",
"value": "Kovid Goyal",
"type": "remediation developer"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-09-25T15:05:06.462333Z",
"id": "CVE-2026-80431",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-09-25T15:07:45.536Z"
}
}
]
}
}