EUVD-2026-100752
GHSA-48h6-7293-hxh6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege access to Windows host
-
ExploitSupply crafted input to Workspace app parser
-
ExecutionTrigger out-of-bounds read (CWE-125)
-
ImpactLeak adjacent memory or crash client
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to a Windows endpoint running an affected Citrix Workspace app build (before 2603.20 CR, before LTSR 2607, or before LTSR 2507 CU3), plus an existing low-privilege foothold (PR:L) - it is not remotely reachable (AV:L). The CVSS 4.0 vector further flags high attack complexity (AC:H) and present attack requirements (AT:P), indicating specific non-default preconditions or timing must be met for the out-of-bounds read to trigger. No user interaction is required (UI:N). The CVE description does not name a specific feature, protocol, or configuration setting that must be enabled, so the exact triggering condition is not confirmed from available data; the local-only vector, required privileges, and high complexity are the primary limiting factors for defenders. |
| Impact | This is a medium-severity issue (CVSS 4.0 base 5.8) that should be treated as routine patch-cycle work rather than an emergency. The vendor-supplied CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:L/UI:N) describes a hard-to-reach flaw: it requires local access to the Windows endpoint, already-held low privileges (PR:L), high attack complexity (AC:H), and additional attack requirements/preconditions (AT:P). There is no KEV listing and no public exploit identified at time of analysis, so there is no public exploit identified at time of analysis. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. Impact is mixed: the dominant metric is availability (VA:H), consistent with an out-of-bounds read (CWE-125) crashing the client, with only low confidentiality and integrity impact (VC:L/VI:L) - meaning this is more a crash/limited-info-leak bug than a code-execution threat. The combination of local vector, required privileges, high complexity, and extra attack requirements makes mass or remote exploitation implausible; prioritize it below any network-reachable or actively-exploited vulnerabilities. |
| Exploit ScenarioDerived | A low-privileged local user (or malware already running in a user's session) on a Windows machine with the Citrix Workspace app installed supplies crafted input that the app parses, triggering an out-of-bounds read that leaks small amounts of adjacent memory and/or crashes the client (denial of service). Because attack complexity is high and specific preconditions must be met, reliable exploitation is difficult and no public exploit code is known to exist. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
An out-of-bounds read (CWE-125) in Citrix Workspace app for Windows can be triggered by a local, low-privileged user on an affected endpoint, leading to limited confidentiality and integrity impact together with a high availability impact (crash/DoS) as reflected in both the CVSS 4.0 base score of 5.8 and the independent CVSS 3.1 assessment (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H). Only Windows builds prior to 2603.20 CR, prior to LTSR 2607, and prior to LTSR 2507 CU3 are affected. The attack is not remotely reachable, requires an existing foothold on the host and specific high-complexity preconditions or timing flagged by AT:P and AC:H, and no public exploit code has been identified at time of analysis; this is routine patch-cycle work rather than an emergency.
RemediationAI
Vendor-released patch: upgrade Citrix Workspace app for Windows to 2603.20 CR or later on the Current Release track, or to LTSR 2607 or later, or to LTSR 2507 CU3 or later, on the respective LTSR tracks - the fixes are delivered through the standard Citrix Workspace app update channels described in advisory CTX697181 (https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697181). Because the flaw is local (AV:L) and requires an existing low-privileged foothold plus high-complexity preconditions, the practical exposure is that any process already running as a standard user on an affected Windows endpoint could reach the vulnerable code path; the most effective complementary control is therefore to restrict interactive and service-level access to trusted users and to remove unnecessary local accounts, accepting the operational cost of tighter endpoint access management. Where immediate upgrades are not feasible, prioritize patching hosts where untrusted or shared local users exist (VDI gold images, kiosks, jump hosts, contractor laptops) and consider application allow-listing or Windows Defender Application Control to constrain which local binaries can invoke Citrix Workspace components, with the trade-off that allow-listing requires ongoing maintenance and can block legitimate Citrix plug-ins. Blocking the process from running is not a viable workaround since it would disable the corporate remote-access client, and Citrix has not published a configuration toggle that disables only the affected code path, so staged rollout of 2603.20 CR, LTSR 2607, or LTSR 2507 CU3 should be treated as the sole reliable fix. No public exploit code has been identified at time of analysis and no CISA KEV entry exists, so remediation can proceed on a normal patch cycle rather than under emergency change procedures.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is an out-of-bounds read, classified as CWE-125, in the Windows client of Citrix Workspace app - the endpoint component that brokers ICA/HDX sessions between a user's Windows device and Citrix Virtual Apps and Desktops or Citrix DaaS. CWE-125 occurs when code reads memory past the end of an allocated buffer, typically from insufficient length validation or incorrect parsing of a data structure; the consequence is normally information disclosure (disclosing adjacent heap or stack contents) and, frequently, an access violation that terminates the process and produces the high availability impact shown in both the CVSS 4.0 vector (VA:H) and the independent CVSS 3.1 vector (A:H). The published CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H) and the independent 3.1 assessment agree that exploitation is local rather than network-reachable, requires a low-privileged foothold on the Windows endpoint (PR:L), needs no user interaction (UI:N), and is gated by high attack complexity (AC:H) plus present attack requirements (AT:P) - meaning non-default preconditions or precise timing must be satisfied before the out-of-bounds read triggers. Neither the CVE description nor the available references name the specific Citrix Workspace feature, protocol handler, or configuration setting that must be present, so the exact triggering path is not confirmed from available data; the local-only vector, the required privilege level, and the high complexity are the primary factors limiting practical exploitability. The EUVD record (EUVD-2026-100752) mirrors the same three affected branches and vendor advisory from secure@citrix.com.
Know when Citrix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Out-of-bounds read reachable only locally by an authenticated user under specific hard-to-meet conditions, so AV:L/PR:L/AC:H; impact is mainly a crash (A:H) with minor memory leak (C:L).
Primary rating from Vendor (citrix).
CVSS VectorVendor: citrix
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read vulnerability in Citirx Citrix Workspace app for Windows.
This issue affects Citrix Workspace app for Windows: before 2603.20 CR, before LTSR 2607, and before LTSR 2507 CU3.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Citrix Application Delivery Controller and Gateway contain a directory traversal vulnerability allowing unauthenticated
Citrix NetScaler ADC and Gateway contain an unauthenticated remote code execution vulnerability exploited massively in s
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Sensitive information disclosure in Citrix NetScaler ADC and NetScaler Gateway - widely known as 'Citrix Bleed' - allows
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as r
Memory overread in Citrix NetScaler ADC and NetScaler Gateway (versions before 14.1-43.56 and 13.1-58.32) lets remote un
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and
Citrix NetScaler ADC and NetScaler Gateway deployments running builds prior to 14.1-73.37 or 13.1-64.23 (including the c
Unauthenticated command execution in Citrix NetScaler ADC (before 14.1-73.37, before 13.1-64.23, and the corresponding F
A remote, unauthenticated attacker can cause a denial-of-service condition on NetScaler ADC and NetScaler Gateway applia
Unauthenticated information disclosure in Citrix NetScaler ADC and NetScaler Gateway (versions 14.1 before 73.32 and 13.
Exploit-DB