Citrix Workspace App for Windows Out-of-bounds Write (CVE-2026-84419) (CTX697181)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(370485);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/23");

  script_cve_id("CVE-2026-84419");

  script_name(english:"Citrix Workspace App for Windows Out-of-bounds Write (CVE-2026-84419) (CTX697181)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Citrix Workspace App for Windows installed on the remote host is 2507.1 LTSR prior to 2507.1 LTSR CU3
Hotfix 1, or Current Release prior to 2603.20, or 2607 LTSR prior to 2607 LTSR Hotfix 1. It is, therefore, affected by
an out-of-bounds write vulnerability as referenced in the CTX697181 advisory.

  - Out-of-bounds write vulnerability in Citrix Workspace app for Windows. This issue affects Workspace app
    for Windows: before 2603.20 CR, before LTSR 2607 Hotfix 1, and before LTSR 2507 CU3 Hotfix 1.
    (CVE-2026-84419)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697181
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e4e9a075");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Citrix Workspace App for Windows 2603.20 CR, 2507.1 LTSR CU3 Hotfix 1, 2607 LTSR Hotfix 1 or later.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-84419");
  script_set_attribute(attribute:"cvss_score_rationale", value:"Score based on analysis of the vendor advisory.");
  script_set_attribute(attribute:"cvss3_score_rationale", value:"Score based on analysis of the vendor advisory.");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(787);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/22");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:citrix:workspace");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("citrix_workspace_win_installed.nbin");
  script_require_keys("installed_sw/Citrix Workspace", "SMB/Registry/Enumerated", "Settings/ParanoidReport");

  exit(0);
}

include('vdf.inc');

# The advisory lists the App Protection feature being enabled as a pre-condition; that configuration is not checked.
if (report_paranoia < 2) audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}}
  ],
  'checks': [
    {
      'product': {'name': 'Citrix Workspace', 'type': 'app'},
      'check_algorithm': 'default',
      'potential_vulnerability': {
        'missing_config_check': true
      },
      'constraints': [
        { 'min_version' : '25.7.0.0', 'fixed_version' : '25.7.3001', 'fixed_display' : '2507.1 LTSR CU3 Hotfix 1 or 2607 LTSR Hotfix 1' },
        { 'min_version' : '25.8.0.0', 'fixed_version' : '26.3.20', 'fixed_display' : '2603.20 CR or 2607 LTSR Hotfix 1' },
        { 'min_version' : '26.7.0.0', 'fixed_version' : '26.7.1', 'fixed_display' : '2607 LTSR Hotfix 1' }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);