---
cve: "CVE-2026-80431"
severity: "MEDIUM"
cvss: 6.8
epss: "0.1%"
vendor: "Kovid Goyal"
kev: false
exploited: false
published: "2026-09-25 14:17:19"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-10-02T00:47:47+02:00"
---

# CVE-2026-80431

> 6.8 MEDIUM · 🧪 PoC

## Beschreibung

Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screen_handle_multicell_command() in kitty/screen.c appends each codepoint of a grapheme cluster with lc.chars[lc.count++] = ch without any capacity check, while lc is declared by the RAII_ListOfChars macro as a four-element char_type array in the function's stack frame, so an OSC 66 escape code whose payload carries a grapheme cluster longer than four codepoints writes beyond that buffer, one 32-bit value per additional codepoint, in the order the codepoints appear. Where the cluster is preceded in the same payload by a sequence that causes an intermediate flush, the buffer is first migrated to the heap by ensure_space_for_chars() and the write occurs past the heap allocation instead. This results in termination of the kitty process and therefore of all its windows, tabs and child processes.

## CVSS-Vektor

```
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |

## Patch verfügbar (OSV)

- 07ed6aa3de28af2a01e521f18c56ed292aa34cfc (Commit)
- 7d2fbaadcc2b1eeeef89bd875ec622b42362574b (Commit)

## Referenzen

- <https://github.com/kovidgoyal/kitty/commit/7d2fbaadcc2b1eeeef89bd875ec622b42362574b>
- <https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0>
- <https://secur0.com/en/cna/cve-list/cve-2026-80431-kitty-text-sizing-out-of-bounds-write>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-80431) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_