CVE-2026-28412: Textream macOS Teleprompter DoS Vulnerability

CVE-2026-28412 Overview

CVE-2026-28412 is a Resource Exhaustion vulnerability affecting Textream, a free macOS teleprompter application. Prior to version 1.5.1, the DirectorServer WebSocket server imposes no limit on concurrent connections. Combined with a broadcast timer that sends state to all connected clients every 100 ms, an attacker can exhaust CPU and memory by flooding the server with connections, causing the Textream application to freeze and crash during a live session.

Critical Impact
Attackers can remotely crash Textream during live teleprompter sessions by flooding the WebSocket server with unlimited connections, potentially disrupting live broadcasts, presentations, or video productions.

Affected Products

Textream versions prior to 1.5.1
macOS systems running vulnerable Textream installations
Live production environments utilizing Textream's director functionality

Discovery Timeline

2026-03-02 - CVE CVE-2026-28412 published to NVD
2026-03-04 - Last updated in NVD database

Technical Details for CVE-2026-28412

Vulnerability Analysis

This vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). The DirectorServer component in Textream implements a WebSocket server that allows remote control and synchronization between teleprompter clients and a director interface. The server broadcasts application state to all connected clients at a high frequency (every 100 milliseconds) to maintain real-time synchronization.

The critical flaw lies in the absence of connection limiting mechanisms. Without any cap on concurrent connections, an attacker can establish thousands of WebSocket connections to the server. Each connection consumes server-side resources, and the broadcast timer amplifies the impact by attempting to send state updates to every connected client at the 100ms interval.

Root Cause

The root cause is the lack of connection throttling or limiting in the DirectorServer WebSocket implementation. The server accepts all incoming connection requests without enforcing a maximum connection limit, making it susceptible to connection-flooding attacks. The high-frequency broadcast mechanism (100ms interval) exacerbates the issue by consuming additional CPU cycles for each connected client.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with network access to the Textream application can initiate the attack by:

Identifying a running Textream instance with the DirectorServer WebSocket server active
Establishing a large number of concurrent WebSocket connections to the server
Maintaining these connections to force the server to broadcast state updates to all of them
Observing as CPU and memory resources are exhausted, causing application freeze and crash

The following patch demonstrates the fix implemented in version 1.5.1:

text

     private var authenticatedConnections: Set<ObjectIdentifier> = []
     private var broadcastTimer: Timer?
 
+    // Connection limit to prevent resource exhaustion (CWE-400)
+    private let maxConnections = 5
+
+    // Dedicated queue for broadcasting to avoid blocking the main/UI thread
+    private let broadcastQueue = DispatchQueue(label: "com.textream.director.broadcast")
     // Security: shared secret token for WebSocket authentication
     private var authToken: String = ""

Source: GitHub Commit Update

Detection Methods for CVE-2026-28412

Indicators of Compromise

Abnormally high number of WebSocket connections to the Textream application
Unusual CPU or memory spikes on systems running Textream
Textream application becoming unresponsive or crashing during active sessions
Network traffic showing repeated WebSocket connection attempts from single or multiple sources

Detection Strategies

Monitor network connections to identify flooding patterns targeting WebSocket services
Implement application performance monitoring to detect sudden resource consumption spikes
Review system logs for Textream crash events or out-of-memory conditions
Configure network intrusion detection rules for WebSocket connection flooding patterns

Monitoring Recommendations

Enable connection logging on network firewalls to track WebSocket traffic to Textream
Set up alerts for abnormal connection rates to macOS applications
Monitor system resource utilization during live Textream sessions
Implement network flow analysis to detect connection flooding attempts

How to Mitigate CVE-2026-28412

Immediate Actions Required

Upgrade Textream to version 1.5.1 or later immediately
Restrict network access to Textream's WebSocket server to trusted clients only
Consider running Textream behind a firewall or VPN during live sessions
Monitor for signs of exploitation if running vulnerable versions

Patch Information

The vulnerability has been addressed in Textream version 1.5.1. The fix introduces a connection limit (maxConnections = 5) to prevent resource exhaustion attacks and adds a dedicated dispatch queue for broadcasting to avoid blocking the main UI thread. The security patch is available via GitHub Commit 3524fa9. Full details are documented in the GitHub Security Advisory GHSA-qr5p-7x47-qxh9.

Workarounds

Limit network access to the Textream WebSocket server using firewall rules
Deploy Textream on an isolated network segment during live productions
Use a reverse proxy with connection limiting capabilities in front of the WebSocket server
Disable the director feature if remote control functionality is not required

bash

# Example: Limit connections to Textream WebSocket port using macOS pf firewall
# Add to /etc/pf.conf (adjust port number as needed)
pass in on en0 proto tcp to any port 8080 keep state (max 5, source-track rule, max-src-conn 2)

# Reload pf rules
sudo pfctl -f /etc/pf.conf
sudo pfctl -e