Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is required. No non-default configuration is required. The attacker only needs the ability to produce output in a kitty terminal window. This issue has been fixed in version 0.47.0.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8442-1 advisory.

    It was discovered that kitty incorrectly handled certain image data. An attacker able to write to the     terminal's input could possibly use this issue to cause kitty to crash, resulting in a denial of service,     or possibly execute arbitrary code. (CVE-2026-33633)

    It was discovered that kitty incorrectly handled certain graphics commands. An attacker able to write     escape sequences to a kitty terminal could possibly use this issue to cause kitty to crash, resulting in a     denial of service, or possibly execute arbitrary code. (CVE-2026-33642)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6307 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6307-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     May 28, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : kitty     CVE ID         : CVE-2026-33633 CVE-2026-33642     Debian Bug     : 1137210

    Two vulnerabilities were discovered in kitty, a GPU based terminal     emulator, which may result in the execution of arbitrary code or denial     of service.

    For the stable distribution (trixie), these problems have been fixed in     version 0.41.1-2+deb13u1.

    We recommend that you upgrade your kitty packages.

    For the detailed security status of kitty please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/kitty

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command()     function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit     arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An     attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner,     or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping     but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is     required. No non-default configuration is required. The attacker only needs the ability to produce output     in a kitty terminal window. This issue has been fixed in version 0.47.0. (CVE-2026-33642)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
338650	openSUSE 16 Security Update : kitty (openSUSE-SU-2026:21599-1)	Nessus	SuSE Local Security Checks	Local	high
321729	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : kitty vulnerabilities (USN-8442-1)	Nessus	Ubuntu Local Security Checks	Local	critical
317445	Debian dsa-6307 : kitty - security update	Nessus	Debian Local Security Checks	Local	critical
316406	Linux Distros Unpatched Vulnerability : CVE-2026-33642	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-33642

critical

Tenable Plugins

high

critical

critical

critical