EUVD-2026-43676
GHSA-x6r5-jm3g-ghrx
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and low privilege align with CVSS 4.0 input; unchanged scope because no subsequent system is impacted; only confidentiality is affected.
Primary rating from Vendor (Citrix).
CVSS VectorVendor: Citrix
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds read vulnerability in Citrix Citrix Secure Access Client for Windows.
This issue affects Citrix Secure Access Client for Windows: before 26.6.1.20.
AnalysisAI
Out-of-bounds read in Citrix Secure Access Client for Windows (all versions before 26.6.1.20) enables a local low-privileged attacker to read memory beyond an allocated buffer boundary, resulting in high confidentiality impact with no integrity or availability consequence. The CVSS 4.0 score of 6.8 reflects the local attack vector and low-privilege requirement, meaning an attacker must already hold a foothold on the endpoint. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Technical ContextAI
CWE-125 (Out-of-Bounds Read) describes a condition where software reads data from memory at a position before the start or past the end of an intended buffer, potentially exposing adjacent memory contents to the caller. The affected component is the Citrix Secure Access Client for Windows (CPE: cpe:2.3:a:citrix:citrix_secure_access_client_for_windows:*:*:*:*:*:*:*:*), which is the endpoint agent used to establish encrypted VPN tunnels to Citrix Gateway and related infrastructure. Because VPN clients handle authentication credentials, session tokens, and network configuration data in memory, an out-of-bounds read in this component carries meaningful confidentiality risk - the specific memory region disclosed could contain sensitive connection artifacts. The local attack vector (AV:L in the CVSS 4.0 vector) indicates the triggering condition is accessible from a local user context rather than over a network interface.
RemediationAI
Vendor-released patch: upgrade Citrix Secure Access Client for Windows to version 26.6.1.20 or later per Citrix advisory CTX696734 at https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696734. If immediate patching is not operationally feasible, restrict local logon rights on endpoints running the Citrix Secure Access Client to authorized users only - removing interactive login for non-essential accounts reduces the pool of principals who could trigger the read. Additionally, enforcing application-layer auditing of process memory access (via EDR policies) can detect anomalous reads against the client process. Neither workaround eliminates the underlying flaw; patching to 26.6.1.20 is the only confirmed remediation.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today