The vulnerability is an integer overflow in the bounds validation of composition offsets within kitty’s graphics compositing routine. This overflow allows an attacker to craft escape sequences that pass the bounds check after wrapping, resulting in large out‑of‑bounds heap reads or writes in compose_rectangles(). The memory corruption can enable data exfiltration, corruption of other processes, or remote code execution if an attacker can target specific memory locations in the same process space.

Vendor kovidgoyal:kitty. Versions 0.46.2 and earlier of the kitty terminal are affected. The issue affects all supported platforms (Windows, macOS, Linux) since kitty is cross‑platform. No special configuration is required for the flaw to be exploitable.

The CVSS score of 9.9 classifies this as critical. The EPSS score is unavailable, but the automated nature of the danger and the lack of user interaction suggest a non‑negligible risk of exploitation. The flaw is not listed in CISA’s KEV catalog. An attacker can inject malicious escape sequences from any source that the terminal accepts, such as a malicious file, an SSH banner, or piped input, and can achieve the overflow without user action, making the threat realistic for unattended or remote sessions.