The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8442-1 advisory.

    It was discovered that kitty incorrectly handled certain image data. An attacker able to write to the     terminal's input could possibly use this issue to cause kitty to crash, resulting in a denial of service,     or possibly execute arbitrary code. (CVE-2026-33633)

    It was discovered that kitty incorrectly handled certain graphics commands. An attacker able to write     escape sequences to a kitty terminal could possibly use this issue to cause kitty to crash, resulting in a     denial of service, or possibly execute arbitrary code. (CVE-2026-33642)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in     load_image_data() that allows any process which can write to the terminal's stdin to crash kitty     immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format     declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-     controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue     has been fixed in version 0.47.0. (CVE-2026-33633)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6307 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6307-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     May 28, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : kitty     CVE ID         : CVE-2026-33633 CVE-2026-33642     Debian Bug     : 1137210

    Two vulnerabilities were discovered in kitty, a GPU based terminal     emulator, which may result in the execution of arbitrary code or denial     of service.

    For the stable distribution (trixie), these problems have been fixed in     version 0.41.1-2+deb13u1.

    We recommend that you upgrade your kitty packages.

    For the detailed security status of kitty please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/kitty

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
321729	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : kitty vulnerabilities (USN-8442-1)	Nessus	Ubuntu Local Security Checks	6/20/2026	8/25/2026	critical
338650	openSUSE 16 Security Update : kitty (openSUSE-SU-2026:21599-1)	Nessus	SuSE Local Security Checks	8/21/2026	8/21/2026	high
316426	Linux Distros Unpatched Vulnerability : CVE-2026-33633	Nessus	Misc.	5/22/2026	9/2/2026	high
317445	Debian dsa-6307 : kitty - security update	Nessus	Debian Local Security Checks	5/28/2026	8/14/2026	critical

Detections

Analytics

Plugins Search

critical

high

high

critical