{"schema":"threatline.record/2","record":{"id":"CVE-2026-80431","aliases":[],"summary":"Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process","details":"Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screen_handle_multicell_command() in kitty/screen.c appends each codepoint of a grapheme cluster with lc.chars[lc.count++] = ch without any capacity check, while lc is declared by the RAII_ListOfChars macro as a four-element char_type array in the function's stack frame, so an OSC 66 escape code whose payload carries a grapheme cluster longer than four codepoints writes beyond that buffer, one 32-bit value per additional codepoint, in the order the codepoints appear. Where the cluster is preceded in the same payload by a sequence that causes an intermediate flush, the buffer is first migrated to the heap by ensure_space_for_chars() and the write occurs past the heap allocation instead. This results in termination of the kitty process and therefore of all its windows, tabs and child processes.","categories":["Unclassified"],"product":"kitty","vendor":"Kovid Goyal","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-80431","source_modified_at":"2026-09-25T15:07:45.536Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"kitty","vendor":"Kovid Goyal","versions":[{"status":"affected","version":"0.40.0","lessThan":"0.49.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-80431","source_modified_at":"2026-09-25T15:07:45.536Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"kitty","ecosystem":null},"version":"0.49.0","basis":"first unaffected version stated in the CVE record"}],"cvss":6.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00136,"percentile":0.02767,"score_date":"2026-10-23"},"published_at":"2026-09-25T13:23:51.590Z","modified_at":"2026-09-25T15:07:45.536Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-80431","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-25T15:07:45.536Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-80431","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/kovidgoyal/kitty/commit/7d2fbaadcc2b1eeeef89bd875ec622b42362574b","tags":["patch"]},{"source":"CVE List","url":"https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0","tags":["release-notes"]},{"source":"CVE List","url":"https://secur0.com/en/cna/cve-list/cve-2026-80431-kitty-text-sizing-out-of-bounds-write","tags":["third-party-advisory","technical-description"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-25T15:05:06.462333Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-25T15:07:45.536Z","content_hash":"cc366e9635150641b765f6512db6a531695b75be1a2da385931b78cdcdebaec7"}}