CVE-2026-95834 Kovid Goyal CVE debrief

Who should care

Defenders responsible for systems and deployments using kitty versions between 0.47.0 and 0.49.0 should assess potential exposure and impact. They should verify kitty version and system configurations, review system and deployment configurations for potential impact, and consider upgrading to kitty version 0.49.0 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure the security of

Why it matters

CVE-2026-95834 is a use-after-free vulnerability in kitty's drag and drop protocol, allowing a program to access freed memory. Defenders should verify exposure, assess impact, and consider upgrading to mitigate potential risks.

• Potential for terminal crashes or instability
• Possible data corruption or unauthorized access
• Requires verification of kitty version and system configurations
• May necessitate upgrading to kitty version 0.49.0 or later

Technical summary

The vulnerability exists in kitty versions from 0.47.0 before 0.49.0. A program writing to the terminal can cause the terminal to read from and write to freed heap memory due to a use-after-free in the drag source path of the drag and drop protocol. The issue arises from improper handling of the DragRemoteItem pointer in kitty/dnd.c. This allows for potential terminal crashes or instability, and possible data corruption or unauthorized access. Defenders should prioritize verifying exposure and assessing potential impact, focusing on systems and deployments using kitty versions between 0.47.0 and 0.49.0.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on systems and deployments using kitty versions between 0.47.0 and 0.49.0.

Recommended defensive actions

• Verify kitty version and assess exposure
• Review system and deployment configurations for potential impact
• Consider upgrading to kitty version 0.49.0 or later
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and affected versions. However, additional information on exploitation or impact is limited. Defenders should verify kitty version and system configurations, review system and deployment configurations for potential impact, and consider upgrading to kitty version 0.49.0 or later. The vulnerability allows a program to access freed memory, potentially leading to terminal crashes or instability, data corruption, or unauthorized access. There is a

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.