CVE catalog

CVE-2026-80431

Severity: Medium · CVSS 6.8CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Sep 25, 2026, 1:23:51 PM UTC
Updated: Sep 25, 2026, 2:17:19 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.13% · Oct 25, 2026

Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screen_handle_multicell_command() in kitty/screen.c appends each codepoint of a grapheme cluster with lc.chars[lc.count++] = ch without any capacity check, while lc is declared by the RAII_ListOfChars macro as a four-element char_type array in the function's stack frame, so an OSC 66 escape code whose payload carries a grapheme cluster longer than four codepoints writes beyond that buffer, one 32-bit value per additional codepoint, in the order the codepoints appear. Where the cluster is preceded in the same payload by a sequence that causes an intermediate flush, the buffer is first migrated to the heap by ensure_space_for_chars() and the write occurs past the heap allocation instead. This results in termination of the kitty process and therefore of all its windows, tabs and child processes.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	kitty	sid	`0.48.2-1.1`	vulnerable
Debian	kitty	forky	`0.48.2-1.1`	vulnerable
Debian	kitty	trixie	`0.41.1-2+deb13u2`	vulnerable
Debian	kitty	trixie-security	`0.41.1-2+deb13u2`	vulnerable
Debian	kitty	bookworm	`0.26.5-5`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	kitty	source	sid	`(unfixed)`	not yet assigned	Not reported	[1149729]
Debian	kitty	source	forky	`(unfixed)`	not yet assigned	Not reported	[1149729]
Debian	kitty	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1149729]
Debian	kitty	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1149729]

[Debian bug #1149729]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[kitty]Affected
Details (2)
- 0.26.5-5 · amd64 · bookworm
  Affected
  nvd · kitty · debian · bookworm; nvd · kitty · debian · 12
- 0.26.5-5 · arm64 · bookworm
  Affected
  nvd · kitty · debian · bookworm; nvd · kitty · debian · 12
[kitty-doc]Affected
Source package: [kitty]
Details (2)
- 0.26.5-5 · all · bookworm
  Affected
  nvd · kitty · debian · bookworm; nvd · kitty · debian · 12
- 0.26.5-5 · all · bookworm
  Affected
  nvd · kitty · debian · bookworm; nvd · kitty · debian · 12
[kitty-shell-integration]Affected
Source package: [kitty]
Details (2)
- 0.26.5-5 · all · bookworm
  Affected
  nvd · kitty · debian · bookworm; nvd · kitty · debian · 12
- 0.26.5-5 · all · bookworm
  Affected
  nvd · kitty · debian · bookworm; nvd · kitty · debian · 12
[kitty-terminfo]Affected
Source package: [kitty]
Details (2)
- 0.26.5-5 · all · bookworm
  Affected
  nvd · kitty · debian · bookworm; nvd · kitty · debian · 12
- 0.26.5-5 · all · bookworm
  Affected
  nvd · kitty · debian · bookworm; nvd · kitty · debian · 12

[Debian 13 (Trixie)]

[kitty]Affected
Details (4)
- 0.41.1-2+deb13u1 · amd64 · trixie
  Affected
  nvd · kitty · debian · 13
- 0.41.1-2+deb13u1 · arm64 · trixie
  Affected
  nvd · kitty · debian · 13
- 0.41.1-2+deb13u2 · amd64 · trixie-security
  Affected
  nvd · kitty · debian · 13
- 0.41.1-2+deb13u2 · arm64 · trixie-security
  Affected
  nvd · kitty · debian · 13
[kitty-doc]Affected
Source package: [kitty]
Details (4)
- 0.41.1-2+deb13u1 · all · trixie
  Affected
  nvd · kitty · debian · 13
- 0.41.1-2+deb13u1 · all · trixie
  Affected
  nvd · kitty · debian · 13
- 0.41.1-2+deb13u2 · all · trixie-security
  Affected
  nvd · kitty · debian · 13
- 0.41.1-2+deb13u2 · all · trixie-security
  Affected
  nvd · kitty · debian · 13
[kitty-shell-integration]Affected
Source package: [kitty]
Details (4)
- 0.41.1-2+deb13u1 · all · trixie
  Affected
  nvd · kitty · debian · 13
- 0.41.1-2+deb13u1 · all · trixie
  Affected
  nvd · kitty · debian · 13
- 0.41.1-2+deb13u2 · all · trixie-security
  Affected
  nvd · kitty · debian · 13
- 0.41.1-2+deb13u2 · all · trixie-security
  Affected
  nvd · kitty · debian · 13
[kitty-terminfo]Affected
Source package: [kitty]
Details (4)
- 0.41.1-2+deb13u1 · all · trixie
  Affected
  nvd · kitty · debian · 13
- 0.41.1-2+deb13u1 · all · trixie
  Affected
  nvd · kitty · debian · 13
- 0.41.1-2+deb13u2 · all · trixie-security
  Affected
  nvd · kitty · debian · 13
- 0.41.1-2+deb13u2 · all · trixie-security
  Affected
  nvd · kitty · debian · 13

Observed: Oct 27, 2026, 5:02:14 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]