Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0.
0.14.3-10.14.4-10.14.6-10.15.0-10.15.0-1build10.15.0-1ubuntu0.20.19.3-10.21.2-10.21.2-1build10.21.2-1ubuntu0.22.04.10.26.5-3ubuntu20.26.5-5ubuntu10.31.0-30.31.0-40.32.2-10.32.2-1build20.32.2-1build30.32.2-1ubuntu0.10.32.2-1ubuntu0.20.32.2-1ubuntu0.3+1 more0.39.1-10.41.1-20.41.1-20.43.1-10.44.0-10.45.0-10.45.0-1build1Exploitability
AV:NAC:HPR:NUI:RScope
S:UImpact
C:HI:HA:HCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H