A buffer overrun in kitty’s text sizing protocol can be triggered by an OSC 66 escape code that contains a grapheme cluster longer than four codepoints. When the terminal processes such a payload, the routine that appends codepoints writes past the end of a four‑element stack buffer, and if an intermediate flush has migrated the buffer to the heap the write happens beyond the heap allocation. The result is that the kitty process exits abruptly, killing all tabs, windows and any child processes that rely on the terminal.

The vulnerability affects Kovid Goyal’s kitty terminal emulator from version 0.40.0 up to, but not including, 0.49.0. Any installation running one of those pre‑0.49 releases is potentially vulnerable.

The CVSS v3 base score of 6.8 indicates moderate severity. The EPSS score is not available, and the vulnerability is not recorded in CISA’s KEV catalog. Because the flaw is exercised by sending a specific control sequence to a terminal, the attack is local and requires a program that can write arbitrary data to kitty; it cannot be triggered over a network unless the terminal is exposed to such input. Exploitation would likely involve clever crafting of an OSC 66 payload by an attacker with local access or by a malicious application running under the user’s account. The impact is the loss of terminal functionality for that user session.