CVE-2026-45184 affects Kdenlive before version 26.04.1 and involves the acceptance of dangerous proxy parameters when processing project files controlled by an attacker. This vulnerability is categorized under CWE-829, which concerns the inclusion of functionality from an untrusted control sphere. The CVSS 3.1 base score is 6.5, with an attack vector limited to local (AV:L), high attack complexity (AC:H), no privileges required (PR:N), and user interaction required (UI:R). The impact includes high confidentiality and integrity impact, with low availability impact. No patch or official remediation guidance is currently available from the vendor.

An attacker who can provide a malicious project file locally to a vulnerable Kdenlive installation may cause the application to process dangerous proxy parameters, potentially leading to unauthorized disclosure or modification of information (high confidentiality and integrity impact). The availability impact is low. Exploitation requires local access and user interaction, with high attack complexity, reducing the likelihood of widespread exploitation. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid opening project files from untrusted sources to mitigate risk. Monitor KDE's official channels for updates regarding patches or workarounds.