Description

Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23  leading to unpredictable or erroneous behavior or Denial of Service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-27T17:16:56.870Z",
  "pubdate": "2026-09-27T17:16:56.870Z",
  "executiveSummary": "A memory overflow vulnerability has been identified within Citrix NetScaler ADC and Citrix NetScaler Gateway. This flaw resides in the memory management logic, allowing for the potential corruption of process memory. The primary impact of successful exploitation is the degradation of system stability, manifesting as erroneous application behavior or a complete Denial of Service (DoS) of the affected appliance.\nThe vulnerability affects multiple versions of Citrix NetScaler ADC and Gateway, including standard, FIPS, and NDcPP variants. Given the critical role these appliances play as entry points to corporate networks and application infrastructures, the risk to organizational availability is high. An attacker capable of triggering the overflow could cause an unscheduled crash, disrupting all traffic proxied through the device.\nExploitation does not necessarily require highly sophisticated techniques, though it relies on the attacker's ability to supply input that exceeds memory allocation boundaries. Because these appliances are typically internet-facing, the network exposure is significant. Organizations are advised to prioritize the application of vendor-supplied patches to mitigate the risk of service disruption.\nThere is no indication of remote code execution (RCE) based on the provided data, but the availability impact constitutes a severe operational risk for business continuity.",
  "technicalDetails": "The vulnerability is characterized as a memory overflow condition within the Citrix NetScaler ADC and Citrix NetScaler Gateway software stack. Memory overflows occur when an application writes data beyond the boundaries of a pre-allocated memory buffer. In this instance, the flaw involves improper handling of incoming data packets or requests, leading to memory corruption that disrupts the execution flow of the affected process.\nThe root cause is likely an insufficient boundary check during the processing of network traffic or specific protocol headers, which triggers an overflow in the heap or stack memory associated with the appliance's packet processing engine or management interface. When the memory overflow occurs, the system's runtime environment enters an unstable state due to the corruption of adjacent control structures or function pointers.\nThe attack flow commences when an unauthenticated or authenticated attacker—depending on the specific entry point—sends a specially crafted payload to the target device. The appliance attempts to parse this input, leading to a buffer overflow. As the overflow overwrites critical memory space, the underlying process may encounter segmentation faults or illegal memory access violations, causing the service to hang or crash.\nAffected software versions include: Citrix NetScaler ADC before 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, and 13.1.37.279 FIPS and NDcPP; and Citrix NetScaler Gateway before 14.1-73.37 and 13.1-64.23. The scope of the vulnerability suggests that the memory management failure is inherent in the core networking subsystem of the NetScaler platform.\nPost-exploitation impact is primarily focused on system availability. By repeatedly triggering the overflow, an adversary can maintain a state of Denial of Service, effectively severing external access to the applications protected by the ADC or Gateway. While the provided description focuses on unpredictable behavior and DoS, memory corruption vulnerabilities often have the theoretical potential for escalation if the memory overwrite can be controlled precisely to redirect execution flow; however, the current impact is defined by service disruption and instability."
}