EUVD-2026-43676
GHSA-x6r5-jm3g-ghrx
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and low privilege align with CVSS 4.0 input; unchanged scope because no subsequent system is impacted; only confidentiality is affected.
Primary rating from Vendor (Citrix).
CVSS VectorVendor: Citrix
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds read vulnerability in Citrix Citrix Secure Access Client for Windows.
This issue affects Citrix Secure Access Client for Windows: before 26.6.1.20.
AnalysisAI
Out-of-bounds read in Citrix Secure Access Client for Windows (all versions before 26.6.1.20) enables a local low-privileged attacker to read memory beyond an allocated buffer boundary, resulting in high confidentiality impact with no integrity or availability consequence. The CVSS 4.0 score of 6.8 reflects the local attack vector and low-privilege requirement, meaning an attacker must already hold a foothold on the endpoint. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active local session on a Windows endpoint with at least low-privilege user rights (PR:L per CVSS 4.0 vector) and Citrix Secure Access Client for Windows installed in a version prior to 26.6.1.20. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) scores 6.8 and represents a constrained threat profile: exploitation is strictly local, requires at least a low-privilege authenticated session, and produces only a confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has already obtained a low-privilege local session on a Windows endpoint - through phishing, credential reuse, or a prior vulnerability - executes a crafted interaction targeting the Citrix Secure Access Client process. The out-of-bounds read condition is triggered, causing the client to return memory contents beyond the intended buffer, potentially including in-memory credentials, session tokens, or configuration data handled by the VPN client. … |
| Remediation | Vendor-released patch: upgrade Citrix Secure Access Client for Windows to version 26.6.1.20 or later per Citrix advisory CTX696734 at https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696734. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today