Description
Out-of-bounds read vulnerability in Citirx Citrix Workspace app for Windows.

This issue affects Citrix Workspace app for Windows: before 2603.20 CR, before LTSR 2607, and before LTSR 2507 CU3.
Published: 2026-10-13
Score: 5.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Out-of-Bounds Memory Access
Action: Patch
AI Analysis

Impact

This vulnerability involves an out‑of‑bounds read within the Citrix Workspace app for Windows. The bug is a CWE‑125 weakness and has a CVSS score of 5.8. Because it may allow an attacker to read memory that should be protected, sensitive information could be exposed. No write or code‑execution capability is referenced in the provided description.

Affected Systems

Citrix Workspace app for Windows is affected by this bug. Versions susceptible include any release prior to 2603.20 CR, any build before LTSR 2607, and any release before LTSR 2507 CU3. Users running these older versions are at risk; newer releases past these checkpoints are not impacted.

Risk and Exploitability

The estimated EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalogue, indicating a low likelihood of widespread exploitation at present. The CVSS score of 5.8 places this issue in the medium risk range. The attack path appears to require interaction with the application or a user who can trigger the vulnerable code path, as no public remote execution vectors are documented. Inferred from the description that the primary vector would involve local or privileged application use.

Generated by OpenCVE AI on October 16, 2026 at 01:58 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Citrix Workspace app to at least version 2603.20 CR, or a later LTSR 2607 or LTSR 2507 CU3 release that contains the fix.
  • Apply AppLocker or software restriction policies to limit execution of the Workspace app, ensuring only trusted users or services can run the pinned executable.
  • Enable detailed event logging for Windows memory and process events to monitor for anomalous access patterns that might indicate exploitation attempts.

Generated by OpenCVE AI on October 16, 2026 at 01:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Description Out-of-bounds read vulnerability in Citirx Citrix Workspace app for Windows. This issue affects Citrix Workspace app for Windows: before 2603.20 CR, before LTSR 2607, and before LTSR 2507 CU3.
Title Out-of-Bounds Write and Out-of-Bounds Read
Weaknesses CWE-125
References
Metrics cvssV4_0

{'score': 5.8, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Citrix

Published:

Updated: 2026-10-14T18:26:55.638Z

Reserved: 2026-09-01T17:47:17.683Z

Link: CVE-2026-84420

cve-icon Vulnrichment

Updated: 2026-10-14T18:26:50.235Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T22:18:58.800

Modified: 2026-10-14T19:17:21.930

Link: CVE-2026-84420

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T02:00:16Z

Weaknesses