Buffer underflow in kitty - #VU164395
Published: November 10, 2026
Vulnerability identifier: #VU164395
CSH Severity: Medium
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-124
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code on the system running kitty.
The vulnerability exists due to a buffer underwrite in next_word() in kitty/launcher/shlex.h when processing OSC 133 quoted strings without clearing prev_word_ch between parser states. A remote attacker can trick a victim into displaying crafted terminal output containing repeated single quotes after a dollar sign to decrement the buffer position and overwrite heap memory, causing crashes or potentially executing arbitrary code with adequate heap grooming.
Affected software
kitty
Remediation
Install security update from vendor's website.
kitty - update to 0.49.2