EUVD-2026-76444
GHSA-cmf8-hqjg-89gj
Severity by source
CVSS:4.0/AV:P/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical access (AV:P), high complexity conditions, and low-privilege requirement all confirmed by CVSS 4.0 source vector; no confidentiality impact per VC:N.
Primary rating from Vendor (Citrix).
CVSS VectorVendor: Citrix
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds write vulnerability in Citrix Citrix Workspace app for Windows.
This issue affects Citrix Workspace app for Windows: before 2603.11 Current Release (CR), before 2507.1 LTSR CU3, and before LTSR 2607.
AnalysisAI
Out-of-bounds write (CWE-787) in Citrix Workspace app for Windows allows a physically present, low-privileged attacker to corrupt memory, resulting in high integrity and availability impact on the affected endpoint. Affected versions span all supported tracks: Current Release builds before 2603.11, LTSR 2507.x builds before CU3 (2507.1), and LTSR 2607 builds before the base release. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Physical access to the target Windows machine is required (AV:P) - remote exploitation over a network is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Despite VI:H and VA:H impact ratings, the overall CVSS 4.0 score of 4.4 (Medium) accurately reflects the severely limited exploitation surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a fixed release per the appropriate track: Current Release users should update to 2603.11 or later; LTSR 2507.x customers should update to CU3 (2507.1) or later; LTSR 2607 customers should update to the base 2607 release or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today