Citrix releases Security Bulletin for Workspace App

Affected Environment
Citrix Workspace app for Windows, versions before 2603.11, 2507.1 LTSR CU3, and 2607 LTSR.

Threat Overview
Two vulnerabilities allow local or physical access attackers to trigger out-of-bounds read and write conditions.

Exposure Timeline
Published 8 September 2026, with fixed Workspace app versions already available for all affected branches.

Attack Surface
Local or physical access to systems running Citrix Workspace app for Windows, no network exposure required.

Technical Root Cause
An out-of-bounds read and a separate out-of-bounds write both stem from insufficient memory boundary checks.

Exploitation Pathway
Attacker with local or physical device access reads or writes beyond intended memory boundaries within the app.