CVE-2026-45184 affects KDE's Kdenlive video editing software versions prior to 26.04.1. The vulnerability arises because Kdenlive allows dangerous proxy parameters to be processed when opening project files that are attacker-controlled. This can lead to inclusion of functionality from an untrusted control sphere (CWE-829), potentially compromising confidentiality and integrity of the system or data. The CVSS 3.1 vector indicates the attack requires local access with high attack complexity, no privileges, and user interaction, with unchanged scope. The impact is high on confidentiality and integrity, and low on availability. No patch or official remediation level has been published yet.

Successful exploitation could allow an attacker to leverage dangerous proxy parameters embedded in malicious project files to compromise the confidentiality and integrity of the affected system or data. The attack requires local access and user interaction, with high complexity, limiting the ease of exploitation. Availability impact is low. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid opening project files from untrusted sources to mitigate risk. Monitor KDE's official channels for updates regarding patches or mitigations.