Description

Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-27T17:16:56.750Z",
  "pubdate": "2026-09-27T17:16:56.750Z",
  "executiveSummary": "A critical memory overflow vulnerability has been identified in Citrix NetScaler ADC and Citrix NetScaler Gateway. This flaw allows for improper handling of memory operations, which can be leveraged to induce unpredictable system behavior or a complete Denial of Service (DoS) condition.\nThe vulnerability affects multiple versions of NetScaler ADC and Gateway, including standard, FIPS, and NDcPP editions. Successful exploitation typically results in service disruption, potentially causing the appliance to crash or enter an unstable state, thereby interrupting critical network traffic and authentication services.\nThe risk implication is significant for organizations relying on NetScaler for load balancing, traffic management, and secure remote access, as an attacker could potentially force a system outage without requiring complex authentication mechanisms. Exploitation requires network access to the affected appliance's management or data interface, depending on the specific attack vector targeting the memory management subsystem.",
  "technicalDetails": "The vulnerability is characterized as a memory overflow condition within the architecture of Citrix NetScaler ADC and Gateway. Memory overflows occur when a process attempts to write data beyond the boundaries of a pre-allocated buffer in memory. In the context of NetScaler, this typically involves the improper validation of input length or structure during the parsing of network packets or internal requests processed by the appliance's core components.\nThe root cause resides in the handling of memory buffers during specific operational workflows. When the system receives data that exceeds the capacity of the designated buffer, the application memory space is corrupted. Because the appliance relies on highly optimized, high-performance routines for traffic handling, a memory overflow can overwrite adjacent memory segments containing critical instruction pointers, local variables, or system control structures.\nThe attack flow generally involves an adversary sending a specially crafted sequence of packets or requests to the target NetScaler device. Once the input reaches the vulnerable component, the overflow triggers, leading to immediate memory corruption. Depending on the memory layout and the nature of the overwritten data, the process may experience an illegal memory access or an internal panic, leading to the termination of the service or the appliance entering an unrecoverable, erroneous state (Denial of Service).\nAffected versions are clearly defined: ADC and Gateway prior to 14.1-73.37 and 13.1-64.23; FIPS and NDcPP editions of ADC prior to 14.1-73.37 and 13.1.37.279. The vulnerability is typically exposed via the network interfaces, meaning any actor capable of establishing a connection to the vulnerable service may potentially attempt exploitation.\nPost-exploitation impact is primarily focused on system availability. By repeatedly triggering the overflow, an attacker can maintain a persistent DoS state. While memory overflows can sometimes be leveraged for Remote Code Execution (RCE), the current disclosure specifically highlights unpredictable behavior and service disruption. The lack of robust boundary checking in the affected memory management functions allows the input to overwrite sensitive memory areas, bypassing standard security heap protections if the system lacks modern exploit mitigations like Address Space Layout Randomization (ASLR) or Data Execution Prevention (DEP) at the specific point of vulnerability."
}