PT-2026-22626 · Textream · Textream

Iamcanturk · Published 2026-03-02 · Updated 2026-03-04 · CVE-2026-28412

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Textream versions prior to 1.5.1

Description Textream, a macOS teleprompter application, is susceptible to a denial-of-service condition. The DirectorServer WebSocket server does not limit concurrent connections. This, combined with a broadcast timer sending state updates to all connected clients every 100 milliseconds, allows an attacker to deplete CPU and memory resources by establishing numerous connections. This can lead to the Textream application freezing and crashing, particularly during live sessions. The vulnerable component is the DirectorServer WebSocket server.

Recommendations Update to version 1.5.1 or later.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-28412

GHSA-QR5P-7X47-QXH9

Affected Products

Textream

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28412.json · Exploit
• https://github.com/f/textream/security/advisories/GHSA-qr5p-7x47-qxh9 · Vendor Advisory
• https://github.com/f/textream/commit/3524fa96f98ba17025b48ce9e19d49d859fc2ec1 · Patch
• https://osv.dev/vulnerability/CVE-2026-28412 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28412 · Security Note
• https://t.me/cveNotify/154114 · Telegram Post