CVE-2026-95832

Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain text typed into a prompt displayed by kitty. The handle_remote_askpass() function opens the POSIX shared memory object named in the escape code and writes the user's answer back without verifying ownership or permissions. An attacker can create such an object, cause the victim's kitty to render a prompt of their choosing, and read the typed secret afterwards.

Use After Free vulnerability in the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory. The bug occurs in drag_remote_file_data() in kitty/dnd.c, where a pointer to an array is used after it has been freed by helper functions.

Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the drop, and to continue reading files after the drag leaves the window.

In kitty versions from 0.40.0 to 0.49.0, there is an out-of-bounds write vulnerability in the natural width branch of the text sizing protocol. A program writing to the terminal can send an OSC 66 escape code with a grapheme cluster longer than four codepoints, causing a write past the end of the fixed-size buffer in screen_handle_multicell_command(). This results in termination of the kitty process and all its windows, tabs and child processes.

In kitty versions 0.47.0 to 0.49.0, there is an improper link resolution before file access in the drag source staging path of the drag and drop protocol. A program writing to the terminal can create files and directories outside the staging directory by crafting entries with symlinks and subsequently following them during item creation. This allows the attacker to write to any path writable by the user running kitty.

Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is required. No non-default configuration is required. The attacker only needs the ability to produce output in a kitty terminal window. This issue has been fixed in version 0.47.0.

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.

Kitty terminal versions 0.46.2 and below have a heap buffer overflow in load_image_data(). Any process that can write to the terminal's stdin can send a crafted APC command with a PNG declaration exceeding twice the initial buffer capacity, causing an immediate crash and potentially remote code execution.