CVE-2026-95834

Name of the Vulnerable Software and Affected Versions kitty versions 0.47.0 through 0.48.x

Description A Use After Free issue exists in the drag source path of the drag and drop protocol. A program writing to the terminal can cause the terminal to read from and write to freed heap memory. This occurs because the drag remote file data() function in kitty/dnd.c maintains a DragRemoteItem pointer to an array it does not own. When toplevel data for drag() or subdir data for drag() are called, they may trigger the abrt() macro via add payload() or populate dir entries(). The abrt() macro executes cancel drag(), which calls drag free offer() to free the array. Since the helper functions return void, the caller is unaware of the teardown and proceeds to call all children complete() using the freed pointer, leading to undefined behavior in the terminal process. This is reachable via the byte stream of any program running in the window.

Recommendations Update kitty to version 0.49.0 or later.