CVE-2026-33642 is an integer wrap in the graphics code of the kitty terminal that can lead to heap memory reads and writes outside a buffer. NVD scores it 9.9. It affects kitty 0.46.2 and earlier. Update to kitty 0.46.3.
What's affected
The GitHub advisory lists affected versions as 0.46.2 and below and the patched version as 0.46.3. The flaw is in handle_compose_command() in kitty/graphics.c.
The advisory says the attacker only needs to produce output in a kitty window. Examples it gives are a malicious file, an SSH login banner, or piped content. It says no user interaction and no non default configuration is required.
How to check if you're exposed
Check the installed version:
kitty --version
Anything at or below 0.46.2 is affected. If you installed through a package manager, ask it which version it has and whether your distribution has shipped 0.46.3 yet:
brew list --versions kitty
On Linux, use your distribution's package query. Machines that use kitty only for local work with trusted output carry less practical risk than a jump host or a shared workstation where you often connect to systems you do not control.
What to do now
- Update kitty to 0.46.3 or later.
- Until you have updated, avoid printing untrusted files, banners or remote output inside kitty. This is a precaution of ours, not an advisory workaround.
- Restart every running kitty instance after the update, since an old process keeps running old code.
- If you manage developer machines, add kitty to your software inventory so version checks include terminal emulators.
Why it matters
The record lists three weakness types: CWE-125 out of bounds read, CWE-190 integer overflow or wraparound, and CWE-787 out of bounds write. They chain together here. The advisory says the bounds check used 32 bit unsigned arithmetic. Adding two large numbers wraps around to a small one, so a check that should reject a request passes it.
Terminals parse whatever bytes arrive, which makes them an unusual target. Reading a file, a log line or a login banner is enough to feed them input. Any program that interprets control sequences has this class of risk, and graphics protocols add real parsing work.
The fix for this class is checking the arithmetic itself, for example comparing against the remaining space with subtraction instead of adding offsets first. The record is not marked as exploited in the wild and is not in the CISA KEV catalog.
Quick check
Do I need to click anything to be affected?
The advisory says no user interaction is required. Output reaching the terminal window is enough.
Which version fixes it?
kitty 0.46.3, per the GitHub advisory.
Sources
Last reviewed: 19 October 2026.
