Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Kitty Terminal Crashes or Malware Installed
published 4 months ago
Summary
The Kitty terminal software has two security issues. An attacker could crash the terminal or install malware on a computer if they can write to the terminal's input or send specific commands to it. Update the Kitty terminal to the latest version to fix these issues.
What to do
- Update canonical kitty to version 0.15.0-1ubuntu0.2+esm1.
- Update canonical kitty to version 0.21.2-1ubuntu0.22.04.1+esm1.
- Update canonical kitty to version 0.32.2-1ubuntu0.4+esm1.
- Update canonical kitty to version 0.41.1-2+deb13u1build0.25.10.1.
- Update canonical kitty to version 0.45.0-1ubuntu0.1~esm1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:20.04:LTS | canonical | kitty |
< 0.15.0-1ubuntu0.2+esm1 Fix: upgrade to 0.15.0-1ubuntu0.2+esm1
|
| Ubuntu:Pro:22.04:LTS | canonical | kitty |
< 0.21.2-1ubuntu0.22.04.1+esm1 Fix: upgrade to 0.21.2-1ubuntu0.22.04.1+esm1
|
| Ubuntu:Pro:24.04:LTS | canonical | kitty |
< 0.32.2-1ubuntu0.4+esm1 Fix: upgrade to 0.32.2-1ubuntu0.4+esm1
|
| Ubuntu:25.10 | canonical | kitty |
< 0.41.1-2+deb13u1build0.25.10.1 Fix: upgrade to 0.41.1-2+deb13u1build0.25.10.1
|
| Ubuntu:Pro:26.04:LTS | canonical | kitty |
< 0.45.0-1ubuntu0.1~esm1 Fix: upgrade to 0.45.0-1ubuntu0.1~esm1
|
Original advisory text
kitty vulnerabilities
It was discovered that kitty incorrectly handled certain image data. An
attacker able to write to the terminal's input could possibly use this
issue to cause kitty to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2026-33633)
It was discovered that kitty incorrectly handled certain graphics commands.
An attacker able to write escape sequences to a kitty terminal could
possibly use this issue to cause kitty to crash, resulting in a denial of
service, or possibly execute arbitrary code. (CVE-2026-33642)
attacker able to write to the terminal's input could possibly use this
issue to cause kitty to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2026-33633)
It was discovered that kitty incorrectly handled certain graphics commands.
An attacker able to write escape sequences to a kitty terminal could
possibly use this issue to cause kitty to crash, resulting in a denial of
service, or possibly execute arbitrary code. (CVE-2026-33642)
References
- https://ubuntu.com/security/notices/USN-8442-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-33633 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-33642 Third Party Advisory
Timeline
Published17 Jun 2026
Updated17 Jun 2026
First seen17 Jun 2026
Sources
USN-8442-1 · OSV
Track software like this
Free during beta