CVE-2026-78546: Citrix Workspace Buffer Overflow Vulnerability

CVE-2026-78546 Overview

CVE-2026-78546 is an out-of-bounds read vulnerability [CWE-125] affecting Citrix Workspace app for Windows. A local authenticated attacker can trigger the flaw to read memory outside the intended buffer boundaries, resulting in limited information disclosure or process instability. The issue affects Workspace app for Windows versions before 2603.11 Current Release (CR), before 2507.1 LTSR CU3, and before LTSR 2607. Citrix disclosed the vulnerability in security bulletin CTX697034 alongside CVE-2026-78547.

Critical Impact
A local low-privileged user on a Windows endpoint running a vulnerable Citrix Workspace app can trigger an out-of-bounds memory read that may disclose limited process memory contents.

Affected Products

Citrix Workspace app for Windows before 2603.11 Current Release (CR)
Citrix Workspace app for Windows before 2507.1 LTSR CU3
Citrix Workspace app for Windows before LTSR 2607

Discovery Timeline

2026-09-11 - CVE-2026-78546 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-78546

Vulnerability Analysis

The vulnerability is classified under CWE-125 as an out-of-bounds read. The Citrix Workspace app for Windows reads data past the end of an intended memory buffer during processing. The result is unintended exposure of adjacent memory contents to the calling context.

Exploitation requires local access with low privileges and no user interaction. The impact is limited to confidentiality and availability of the Workspace app process itself. Integrity is not affected, and the vulnerability does not cross a scope boundary to other components. Because the read occurs within the client process, information disclosure is bounded to data accessible within that process address space.

At the time of publication, no public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

Out-of-bounds read defects typically stem from missing or incorrect bounds checks before indexing into a buffer, incorrect length calculations, or mishandling of attacker-influenced size fields. Citrix has not published the specific component or function affected in the public bulletin. Consult the Citrix Security Bulletin CTX697034 for vendor-provided detail.

Attack Vector

The attack vector is local. An authenticated user on a Windows system with a vulnerable Workspace app installation must interact with the affected component to trigger the out-of-bounds read. No network path is required, and no elevated privileges are needed to attempt exploitation. The attacker cannot execute code directly through this flaw, but the leaked memory content could be combined with other primitives to defeat mitigations such as address space layout randomization (ASLR).

No verified exploitation code is available in public sources. Refer to the vendor advisory for authoritative technical details.

Detection Methods for CVE-2026-78546

Indicators of Compromise

Unexpected crashes or abnormal terminations of Citrix Workspace app processes such as wfica32.exe, Receiver.exe, or SelfService.exe on endpoint systems.
Windows Error Reporting (WER) entries or application event log records referencing access violations inside Citrix Workspace binaries.
Presence of installed Citrix Workspace app versions below 2603.11 CR, 2507.1 LTSR CU3, or LTSR 2607 in software inventory data.

Detection Strategies

Inventory endpoints for Citrix Workspace app versions and flag any installation matching the affected version ranges.
Monitor for anomalous local process activity that repeatedly loads Citrix client libraries followed by process crashes.
Correlate application crash telemetry with users who have interactive shell access to identify potential probing activity.

Monitoring Recommendations

Forward Windows Application and System event logs to a central log platform and alert on repeated faults in Citrix Workspace modules.
Track software version drift across managed endpoints using configuration management or endpoint telemetry.
Review Citrix Workspace update compliance during routine patch cycles and after each Citrix bulletin release.

How to Mitigate CVE-2026-78546

Immediate Actions Required

Identify all Windows endpoints running Citrix Workspace app and confirm installed versions against the affected list.
Prioritize upgrades on multi-user systems, jump hosts, and virtual desktop infrastructure where local users share endpoints.
Restrict local access to systems running unpatched Workspace clients until updates are applied.

Patch Information

Citrix has released fixed builds. Upgrade Citrix Workspace app for Windows to 2603.11 Current Release (CR) or later, 2507.1 LTSR CU3 or later, or LTSR 2607 or later. Full remediation guidance is available in the Citrix Security Bulletin CTX697034.

Workarounds

No vendor-supplied workaround is documented in the public advisory; applying the fixed version is the recommended remediation.
Limit interactive logon rights on shared Windows systems to reduce the population of users able to trigger the flaw locally.
Enforce least privilege and application allow-listing to constrain what local users can execute against the Workspace client.

bash

# Query installed Citrix Workspace app version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Citrix Workspace*" } |
  Select-Object DisplayName, DisplayVersion, Publisher