A heap-based buffer overflow in the Kitty terminal emulator could allow a remote, unauthenticated attacker to cause a crash or potentially execute arbitrary code.

This is a heap-based buffer overflow (CWE-122) vulnerability. The flaw exists in the memory management of the terminal emulator, potentially allowing an attacker to overwrite heap memory when processing maliciously crafted data.

The vulnerability carries a CVSS score of 7.5, indicating a High-severity risk. Successful exploitation could lead to arbitrary code execution, resulting in full system compromise for the user running the terminal, or cause a denial-of-service condition that disrupts development and administrative workflows.

Immediate Action: Update the Kitty terminal emulator to version 0.47.0 or later immediately.

Proactive Monitoring: Monitor for unexpected crashes or segmentation faults in terminal processes, which may indicate attempted exploitation.

Compensating Controls: Limit the execution of untrusted terminal commands or sequences from unknown sources until the software can be patched.

Public Exploit Available: Unknown.

Users and administrators of the Kitty terminal should treat this as a high-priority update. Upgrading to version 0.47.0 is the only effective way to remediate the underlying memory safety issue and prevent potential exploitation.