Is there a patch available for CVE-2026-78546?

Yes, a patch is available for CVE-2026-78546. Update the affected software to the latest version immediately.

Citrix Workspace App CVE-2026-78546

Q: What is the CVSS score of CVE-2026-78546?

CVE-2026-78546 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-76445 MEDIUM

Out-of-bounds Read (CWE-125)

2026-09-11 Citrix

GHSA-gccg-q69r-mpxp

Information Disclosure Citrix Workspace App For Windows

4.8

CVSS 4.0 · Vendor: Citrix

Severity by source

Vendor (Citrix) PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.4 MEDIUM

Local attack vector with low-privilege requirement per CVSS 4.0 source; no integrity impact and only partial confidentiality and availability effects.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Citrix).

CVSS VectorVendor: Citrix

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Sep 11, 2026 - 21:18 EUVD

Metadata Corrected

Sep 11, 2026 - 20:40 vuln.today

tag: Citrix added

Metadata Corrected

Sep 11, 2026 - 20:40 vuln.today

tag: Buffer Overflow removed

Metadata Corrected

Sep 11, 2026 - 20:40 vuln.today

tag: Microsoft removed

Analysis Generated

Sep 11, 2026 - 20:00 vuln.today

CVE Published

Sep 11, 2026 - 19:14 cve.org

MEDIUM 4.8

DescriptionCVE.org

Out-of-bounds read vulnerability in Citirx Workspace app for Windows.

This issue affects Workspace app for Windows: before 2603.11 Current Release (CR), before 2507.1 LTSR CU3, and before LTSR 2607.

AnalysisAI

Out-of-bounds read (CWE-125) in Citrix Workspace App for Windows exposes local, low-privileged users to limited memory disclosure and partial availability impact across Current Release and both LTSR branches. An attacker with local access and a standard user account can trigger the defect without user interaction, potentially reading a small amount of process memory and causing intermittent instability. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires local access to the affected Windows endpoint and a user account with at least standard (low-privilege) rights - confirmed by AV:L/PR:L in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 4.8 (Medium) accurately reflects the constrained scope of this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patches are available across all three affected branches. … Detailed patch versions, workarounds, and compensating controls in full report.