Lookup for vulnerable packages by Package URL.
| Purl | pkg:deb/debian/kitty@0.19.3-1?distro=trixie |
|---|
| Type | deb |
|---|
| Namespace | debian |
|---|
| Name | kitty |
|---|
| Version | 0.19.3-1 |
|---|
| Qualifiers |
|
|---|
| Subpath | |
|---|
| Is_vulnerable | true |
|---|
| Next_non_vulnerable_version | 0.19.3-1+deb11u1 |
|---|
| Latest_non_vulnerable_version | 0.47.0-3 |
|---|
| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-rbtm-8gfk-sfb8 |
| vulnerability_id |
VCID-rbtm-8gfk-sfb8 |
| summary |
Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-33633
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-rbtm-8gfk-sfb8 |
|
|
|---|
| Fixing_vulnerabilities |
| 0 |
| url |
VCID-56by-s8qc-2fd3 |
| vulnerability_id |
VCID-56by-s8qc-2fd3 |
| summary |
The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2020-35605
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-56by-s8qc-2fd3 |
|
| 1 |
| url |
VCID-fahg-kn3w-gfdv |
| vulnerability_id |
VCID-fahg-kn3w-gfdv |
| summary |
open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document (e.g., a document opened in KDE ghostwriter). |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-43929
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-fahg-kn3w-gfdv |
|
| 2 |
| url |
VCID-jkr3-br86-cuda |
| vulnerability_id |
VCID-jkr3-br86-cuda |
| summary |
In Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can lead to arbitrary code execution. The user must display attacker-controlled content in the terminal, then click on a notification popup. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
| reference_url |
https://bugs.gentoo.org/868543 |
| reference_id |
868543 |
| reference_type |
|
| scores |
| 0 |
| value |
7.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
Track* |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-05-27T14:49:24Z/ |
|
|
| url |
https://bugs.gentoo.org/868543 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
|
| fixed_packages |
|
| aliases |
CVE-2022-41322
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jkr3-br86-cuda |
|
| 3 |
| url |
VCID-weae-zqfg-akad |
| vulnerability_id |
VCID-weae-zqfg-akad |
| summary |
Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is required. No non-default configuration is required. The attacker only needs the ability to produce output in a kitty terminal window. This issue has been fixed in version 0.47.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-33642
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-weae-zqfg-akad |
|
|
|---|
| Risk_score | null |
|---|
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:deb/debian/kitty@0.19.3-1%3Fdistro=trixie |
|---|