EUVD-2025-18569
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows
Analysis
Local privilege escalation vulnerability in Citrix Workspace app for Windows that allows low-privileged users to gain SYSTEM-level privileges through an improper privilege management flaw (CWE-269). The vulnerability has a CVSS score of 7.8 (High) with low attack complexity and no user interaction required, making it a significant local threat. Status of KEV inclusion, active exploitation, and proof-of-concept availability cannot be confirmed from provided data, but the combination of high CVSS and local attack vector suggests meaningful real-world risk for organizations running Citrix Workspace on Windows endpoints.
Technical Context
The vulnerability stems from CWE-269 (Improper Access Control / Generic Privilege Management Issue) within Citrix Workspace app for Windows. This class of weakness indicates the application fails to properly validate, enforce, or enforce privilege boundaries when transitioning from low-privileged user context to SYSTEM context. Citrix Workspace is the client-side component that enables secure access to virtual applications and desktops; the privilege escalation likely occurs through an unvalidated code path, insecure inter-process communication (IPC) mechanism, or file/registry operation that executes with elevated privileges without proper authentication of the requestor. The vulnerability affects the Windows implementation specifically, suggesting OS-level privilege model exploitation (e.g., Windows token elevation, service exploitation, or scheduled task abuse).
Affected Products
Citrix Workspace app for Windows (specific version range not provided in description; vendor advisories required for exact affected versions and patch availability). Typically, Citrix Workspace versions prior to the patched release are affected. CPE string likely follows pattern: cpe:2.3:a:citrix:workspace:*:*:*:*:*:windows:*:* (exact version range to be sourced from Citrix security advisory). Organizations should cross-reference their installed Citrix Workspace version against Citrix CTX advisory (CTX identifier TBD) to confirm impact.
Remediation
1. Identify installed Citrix Workspace version on affected Windows endpoints using 'Programs and Features' or command-line tooling. 2. Consult Citrix official security advisory/CTX bulletin for CVE-2025-4879 to determine patched versions. 3. Apply vendor-supplied patch/update to Citrix Workspace app, upgrading to the fixed version. 4. If immediate patching is unavailable, implement compensating controls: (a) restrict local user privileges on endpoints where Citrix Workspace is installed, (b) use application allowlisting to limit execution of Citrix Workspace child processes, (c) monitor for suspicious process creation or privilege escalation attempts targeting Citrix Workspace processes, (d) consider disabling Citrix Workspace on endpoints where it is not essential. 5. Conduct post-patch verification via version check or hash validation. Reference official Citrix support portal (support.citrix.com) for advisory CTX-XXXXXX and download patched installer.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today