Description
Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because drag_remote_file_data() in kitty/dnd.c holds a DragRemoteItem pointer into an array it does not own, calls toplevel_data_for_drag() or subdir_data_for_drag(), and then continues to use that pointer. Those helpers, and add_payload() and populate_dir_entries() which they call, report errors through the abrt() macro, which expands to cancel_drag() followed by a plain return, and cancel_drag() calls drag_free_offer(), which frees the array the pointer refers to. The helpers return void, so the caller receives no indication that the teardown happened, and proceeds to call all_children_complete() on the freed pointer, which dereferences it, and then to write through it. That dereference is guarded by a local flag that is set when the request carries no payload and announces no further data, which is the same condition that selects the finalisation block of add_payload(), so the error paths in that block reach it: a create that fails because an entry of the same name already exists, because the client may declare two entries with one name and the create operations use O_CREAT with O_EXCL and symlinkat(), a mkdirat() failure other than EEXIST, and the directory entry allocation paths. Both branches reach it. In the top level branch the caller's pointer is never cleared, so clearing the owning structure's own pointers during teardown does not help. In the sub directory branch subdir_data_for_drag() sets the caller's pointer to NULL on entry and assigns it only after its own last error path, so its own aborts leave the caller with NULL and are stopped by a null check, but it then calls add_payload() with that pointer set, and an abort there leaves the caller holding a freed child node inside the item tree, which drag_free_offer() frees by recursion. This results in undefined behaviour in the terminal process, reachable from the byte stream of any program running in the window.
Published: 2026-09-25
Score: 4.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Use‑after‑free in the drag‑and‑drop protocol that can lead to undefined behaviour in the Kitty terminal, potentially causing crashes or arbitrary code execution within the terminal process.
Action: Patch Immediately
AI Analysis

Impact

The flaw is a CWE-416 Use‑after‑free vulnerability that arises when a drag source item in Kitty’s drag‑and‑drop protocol is aborted mid‑transfer. A pointer to an array that kitty does not own is retained and later used after that array has been freed. This use‑after‑free allows a program that writes to the terminal to cause Kitty to read from and write to freed heap memory, producing undefined behaviour that could manifest as a crash or, in the worst case, arbitrary code execution inside the terminal process.

Affected Systems

The vulnerability affects the Kitty terminal emulator from version 0.47.0 up to, but not including, 0.49.0. The affected vendor is Kovid Goyal; the product is kitty. Users running any of these versions are susceptible.

Risk and Exploitability

With a CVSS score of 4.6 the flaw is considered moderate severity. The EPSS score is currently unavailable, and it is not listed in the CISA KEV catalogue. Attackers can exploit the weakness by sending malformed drag‑and‑drop data from any program that writes to the terminal, a scenario that is local to the user and therefore easily achievable inside a user session. Because the flaw subsists in the byte stream received by Kitty, a malicious application can trigger it without additional privileges. The resulting undefined behavior can lead to denial of service or potential privilege escalation if the attacker gains control of the terminal process.

Generated by OpenCVE AI on September 25, 2026 at 18:59 UTC.

Remediation

Vendor Solution

Upgrade to kitty 0.49.0 or later.

OpenCVE Recommended Actions

  • Upgrade to kitty 0.49.0 or later to remove the use‑after‑free bug.
  • If an upgrade cannot be applied immediately, isolate the terminal session by preventing untrusted or unverified programs from writing to it; for example, run such programs in separate terminal windows or sandboxed environments.
  • Monitor the terminal for sudden crashes or abnormal behaviour and consider disabling the drag‑and‑drop feature in Kitty’s configuration until a patch is available.

Generated by OpenCVE AI on September 25, 2026 at 18:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because drag_remote_file_data() in kitty/dnd.c holds a DragRemoteItem pointer into an array it does not own, calls toplevel_data_for_drag() or subdir_data_for_drag(), and then continues to use that pointer. Those helpers, and add_payload() and populate_dir_entries() which they call, report errors through the abrt() macro, which expands to cancel_drag() followed by a plain return, and cancel_drag() calls drag_free_offer(), which frees the array the pointer refers to. The helpers return void, so the caller receives no indication that the teardown happened, and proceeds to call all_children_complete() on the freed pointer, which dereferences it, and then to write through it. That dereference is guarded by a local flag that is set when the request carries no payload and announces no further data, which is the same condition that selects the finalisation block of add_payload(), so the error paths in that block reach it: a create that fails because an entry of the same name already exists, because the client may declare two entries with one name and the create operations use O_CREAT with O_EXCL and symlinkat(), a mkdirat() failure other than EEXIST, and the directory entry allocation paths. Both branches reach it. In the top level branch the caller's pointer is never cleared, so clearing the owning structure's own pointers during teardown does not help. In the sub directory branch subdir_data_for_drag() sets the caller's pointer to NULL on entry and assigns it only after its own last error path, so its own aborts leave the caller with NULL and are stopped by a null check, but it then calls add_payload() with that pointer set, and an abort there leaves the caller holding a freed child node inside the item tree, which drag_free_offer() frees by recursion. This results in undefined behaviour in the terminal process, reachable from the byte stream of any program running in the window.
Title Use after free in the kitty drag and drop protocol when a drag source item is aborted mid-transfer
First Time appeared Kovidgoyal
Kovidgoyal kitty
Weaknesses CWE-416
CPEs cpe:2.3:a:kovidgoyal:kitty:*:*:*:*:*:*:*:*
Vendors & Products Kovidgoyal
Kovidgoyal kitty
References
Metrics cvssV4_0

{'score': 4.6, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Kovidgoyal Kitty
cve-icon MITRE

Status: PUBLISHED

Assigner: Secur0

Published:

Updated: 2026-09-25T16:59:26.692Z

Reserved: 2026-09-22T16:30:20.014Z

Link: CVE-2026-95834

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-25T17:17:20.223

Modified: 2026-09-29T21:32:59.833

Link: CVE-2026-95834

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T11:30:09Z

Weaknesses