CVE-2026-95834

Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because drag_remote_file_data() in kitty/dnd.c holds a DragRemoteItem pointer into an array it does not own, calls toplevel_data_for_drag() or subdir_data_for_drag(), and then continues to use that pointer. Those helpers, and add_payload() and populate_dir_entries() which they call, report errors through the abrt() macro, which expands to cancel_drag() followed by a plain return, and cancel_drag() calls drag_free_offer(), which frees the array the pointer refers to. The helpers return void, so the caller receives no indication that the teardown happened, and proceeds to call all_children_complete() on the freed pointer, which dereferences it, and then to write through it. That dereference is guarded by a local flag that is set when the request carries no payload and announces no further data, which is the same condition that selects the finalisation block of add_payload(), so the error paths in that block reach it: a create that fails because an entry of the same name already exists, because the client may declare two entries with one name and the create operations use O_CREAT with O_EXCL and symlinkat(), a mkdirat() failure other than EEXIST, and the directory entry allocation paths. Both branches reach it. In the top level branch the caller's pointer is never cleared, so clearing the owning structure's own pointers during teardown does not help. In the sub directory branch subdir_data_for_drag() sets the caller's pointer to NULL on entry and assigns it only after its own last error path, so its own aborts leave the caller with NULL and are stopped by a null check, but it then calls add_payload() with that pointer set, and an abort there leaves the caller holding a freed child node inside the item tree, which drag_free_offer() frees by recursion. This results in undefined behaviour in the terminal process, reachable from the byte stream of any program running in the window.

• CWE-416

• https://github.com/kovidgoyal/kitty/commit/b54bfbb4f85f992edca9b04f5c0c2612454eec23
• https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0
• https://secur0.com/en/cna/cve-list/cve-2026-95834-kitty-dnd-use-after-free

Published

Sep 25, 2026

Last Modified

Sep 25, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-95829A vulnerability was identified in TDuckCloud tduck-platform …6.3
• CVE-2026-9583A weakness has been identified in SourceCodester CET Automat…4.3
• CVE-2026-95830A security flaw has been discovered in theRealSain Pixtream …6.3
• CVE-2026-95831Crypt::SelfCertificate versions from 1.01 through 1.05 for P…7.8
• CVE-2026-95832Improper Neutralization of Special Elements in Output Used b…9.3
• CVE-2026-95833A weakness has been identified in itsourcecode Leave Managem…6.3
• CVE-2026-95835Missing Authorization in the askpass escape code handler in …5.6
• CVE-2026-9584A security vulnerability has been detected in code-projects …7.3
• CVE-2026-95842Moquette is a lightweight Java MQTT broker. Prior to 0.18.1,…7.5
• CVE-2026-95843Moquette is a lightweight Java MQTT broker. Prior to 0.18.1,…7.5
• CVE-2026-95844Moquette is a lightweight Java MQTT broker. Prior to 0.18.1,…8.7
• CVE-2026-95845Moquette is a lightweight Java MQTT broker. Prior to 0.18.1,…7.5