Kovidgoyal vulnerabilities, page 2
24 vulnerabilities
Known vulnerabilities in Kovidgoyal products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 2 products.
HighCVE-2026-33633debian · kitty +2 moreKitty has a Heap Buffer Overflow in its Graphics Protocol HandlerKitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0.EPSS0.46%CriticalCVE-2026-33642debian · kitty +2 moreKitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds CheckKitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is required. No non-default configuration is required. The attacker only needs the ability to produce output in a kitty terminal window. This issue has been fixed in version 0.47.0.EPSS0.43%HighCVE-2026-33206calibre-ebook · calibre +3 morecalibre has a path traversal vulnerabilitycalibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a path traversal vulnerability exists in Calibre' handling of images in Markdown and other similar text-based files allowing an attacker to include arbitrary files from the file system into the converted book. Additionally, missing authentication and server-side request forgery in the background-image endpoint in the ebook reader web view allow the files to be exfiltrated without additional interaction. Version 9.6.0 contains a fix.EPSS0.22%MediumCVE-2026-33205calibre-ebook · calibre +3 morecalibre has Server-Side Request Forgery in ebook viewer backendcalibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a Server-Side Request Forgery vulnerability in the background-image endpoint of calibre e-book reader's web view allows an attacker to perform blind GET requests to arbitrary URLs and exfiltrate information out from the ebook sandbox. Version 9.6.0 patches the issue.EPSS0.17%