CVE-2026-28412CWE-400

Textream Vulnerable to Uncontrolled Resource Consumption (Denial of Service)

Medium · published March 2, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
34.3
In the wild
Unconfirmed
What it is

Textream is a free macOS teleprompter app. Prior to version 1.5.1, the `DirectorServer` WebSocket server imposes no limit on concurrent connections. Combined with a broadcast timer that sends state to all connected clients every 100 ms, an attacker can exhaust CPU and memory by flooding the server with connections, causing the Textream application to freeze and crash during a live session. Version 1.5.1 fixes the issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00412 · 34.3th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-03-02T15:46Z
EPSS history
Timeline
  • 02 MAR 15:46Z
    Textream Vulnerable to Uncontrolled Resource Consumption (Denial of Service)
    cvelistv5