PatchSiren cyber security CVE debrief
CVE-2026-45184 Commits CVE debrief
CVE-2026-45184 is a medium-severity issue in Kdenlive where opening an attacker-controlled project file can lead to dangerous proxy parameters being used before version 26.04.1. The main risk is tied to untrusted project files and user interaction, so teams should treat imported or shared Kdenlive projects as potentially unsafe until the fixed release is in place.
- Vendor
- Commits
- Product
- Unknown
- CVSS
- MEDIUM 6.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-09
- Original CVE updated
- 2026-05-10
- Advisory published
- 2026-05-09
- Advisory updated
- 2026-05-10
Who should care
Kdenlive users, video editors, and workstation administrators who open project files from outside their organization should pay attention. This is especially relevant in environments where project files are exchanged by email, chat, shared storage, or ticketing systems.
Technical summary
According to the NVD description and linked KDE references, Kdenlive before 26.04.1 accepts proxy-related parameters from an attacker-controlled project file in a way that can be dangerous. The published CVSS vector (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L) indicates the issue requires user interaction and can affect confidentiality and integrity significantly, with some availability impact. The listed weakness is CWE-829, which aligns with unsafe handling of externally influenced data or control values.
Defensive priority
Medium. Prioritize if your users regularly open third-party Kdenlive projects or if editors work with files from untrusted sources. Update to the fixed release promptly, but this is not currently marked as KEV or ransomware-linked in the provided corpus.
Recommended defensive actions
- Upgrade Kdenlive to 26.04.1 or later.
- Treat shared or downloaded Kdenlive project files as untrusted input.
- Review workflows that auto-open or routinely import project files from external sources.
- If you cannot upgrade immediately, restrict opening of untrusted project files to trusted workstations and users.
- Monitor vendor advisories and package updates for KDE/Kdenlive security fixes.
Evidence notes
This debrief is based only on the supplied CVE record metadata: the NVD description, CVSS vector, CWE-829 classification, and the referenced KDE advisory and Kdenlive commit links. The vendor field in the source corpus is low-confidence and marked for review, so claims are kept limited to the explicit CVE description and metadata.
Official resources
Published 2026-05-09T23:16:32.787Z and modified 2026-05-10T18:16:08.163Z. The supplied corpus does not identify KEV inclusion or ransomware use.