Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screen_handle_multicell_command() in kitty/screen.c appends each codepoint of a grapheme cluster with lc.chars[lc.count++] = ch without any capacity check, while lc is declared by the RAII_ListOfChars macro as a four-element char_type array in the function's stack frame, so an OSC 66 escape code whose payload carries a grapheme cluster longer than four codepoints writes beyond that buffer, one 32-bit value per additional codepoint, in the order the codepoints appear. Where the cluster is preceded in the same payload by a sequence that causes an intermediate flush, the buffer is first migrated to the heap by ensure_space_for_chars() and the write occurs past the heap allocation instead. This results in termination of the kitty process and therefore of all its windows, tabs and child processes.
Metrics
Affected Vendors & Products
Advisories
No advisories yet.
Fixes
Solution
Upgrade to kitty 0.49.0 or later.
Workaround
No workaround given by the vendor.
References
History
Fri, 25 Sep 2026 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screen_handle_multicell_command() in kitty/screen.c appends each codepoint of a grapheme cluster with lc.chars[lc.count++] = ch without any capacity check, while lc is declared by the RAII_ListOfChars macro as a four-element char_type array in the function's stack frame, so an OSC 66 escape code whose payload carries a grapheme cluster longer than four codepoints writes beyond that buffer, one 32-bit value per additional codepoint, in the order the codepoints appear. Where the cluster is preceded in the same payload by a sequence that causes an intermediate flush, the buffer is first migrated to the heap by ensure_space_for_chars() and the write occurs past the heap allocation instead. This results in termination of the kitty process and therefore of all its windows, tabs and child processes. | |
| Title | Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process | |
| First Time appeared |
Kovidgoyal
Kovidgoyal kitty |
|
| Weaknesses | CWE-787 | |
| CPEs | cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Kovidgoyal
Kovidgoyal kitty |
|
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Secur0
Published:
Updated: 2026-09-25T15:07:45.536Z
Reserved: 2026-08-26T10:49:01.410Z
Link: CVE-2026-80431
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-25T14:17:19.253
Modified: 2026-09-25T16:17:27.880
Link: CVE-2026-80431
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses