CVE-2026-78546

This flaw is like a program accidentally reading a book page just outside the section it’s supposed to use. If that happens in the Citrix Workspace app, an attacker could potentially learn information from the “wrong” part of memory. On a business device, that can turn into exposure of sensitive information or other follow-on compromise.

This matters if you use Citrix Workspace app for Windows on employee PCs to access company apps and desktops. The issue is reachable by default in older versions, so it’s not limited to special setups. Upgrade risk is tied to having a vulnerable installed version (before 2603.11 CR, 2507.1 LTSR CU3, or LTSR 2607).

This is a RED item because it’s a memory-safety bug that can expose unauthorized memory, and the findings indicate it is reachable by default on older Citrix Workspace app for Windows installations. Even though no clear public exploit details are on record, you should still treat this as urgent and patch to the fixed releases.

1. Inventory exposure

   • Identify every machine where “Citrix Workspace app for Windows” is installed.
   • Record the exact installed version.

2. Determine if you’re affected

   • You are affected if the installed version is prior to:
     • 2603.11 Current Release (CR), or
     • 2507.1 LTSR CU3, or
     • LTSR 2607.
       (Use the version number you collected in step 1 to compare.)

3. Upgrade to fixed versions

   • Patch to one of the fixed releases:
     • Workspace app for Windows 2603.11 (CR), or
     • Workspace app for Windows 2507.1 (LTSR CU3), or
     • Workspace app for Windows LTSR 2607.
   • If you manage devices by policy, prioritize endpoints that users log into most frequently.

4. Validate after upgrade

   • Confirm the upgraded version is actually running on each endpoint (not just installed).
   • Check for abnormal behavior: repeated crashes of the client, unexpected session/authentication issues, or unusual network patterns.

5. Temporary risk reduction (if patching is delayed)

   • Reduce exposure by limiting which machines can reach the Citrix environment until they are updated.
   • If you have an internal security policy for client updates, enforce it for Citrix Workspace app for Windows immediately.

6. What to monitor after patching

   • Client stability (crash frequency) and any spikes in login/session anomalies.
   • Endpoint alerts that indicate suspicious behavior originating from the Workspace app process.

Note: KEV is not listed for this CVE, and there is no clear dated public exploitation report in the findings. Still, because the vulnerability is reachable by default in older versions, patching is the correct control.

Severity/impact type: This is an out-of-bounds read (CWE-125), a memory-safety weakness that can cause the application to read data outside intended memory boundaries. That unauthorized memory access can potentially expose sensitive information that may later enable further compromise.

Attack vector and trigger: The findings indicate the issue is caused by application logic or input processing within the Citrix Workspace client, which can lead to unauthorized memory reads.

Reachability: The findings state it is reachable in default configuration for affected versions (i.e., older client versions are exposed without requiring special configuration).

Authentication/user interaction: Authentication required is not specified in the findings, and no user interaction is mentioned.

Exploitation status: No KEV listing, no public exploit code on record, and no clear dated exploitation reporting were provided in the findings.

Fix: Fixed in Workspace app for Windows 2603.11 CR, 2507.1 LTSR CU3, and LTSR 2607.

KEV meaning: KEV would indicate confirmed real-world exploitation prioritized by CISA; since it’s not listed in the findings, confirmed exploitation is not established via KEV here.

EPSS: A prediction was provided (do not rely on it for actionability); the operational driver in this write-up is the default reachability plus the availability of fixed versions.