Research · Aug 26, 2025
Critical Memory Overflow Vulnerability Discovered in Citrix NetScaler
A significant memory overflow vulnerability has been identified in Citrix NetScaler, potentially leading to remote code execution or denial of service.
What changed
A critical memory overflow vulnerability has been uncovered in Citrix NetScaler, which could allow an attacker to execute arbitrary code or cause a denial of service. This vulnerability is particularly concerning when NetScaler is configured as a Gateway or AAA virtual server.
- The issue affects multiple configurations including VPN virtual servers and ICA Proxy.
- It is applicable to LB virtual servers of type HTTP, SSL, or HTTP_QUIC that are bound with IPv6 services.
- Service groups bound with IPv6 servers are also impacted.
Who is affected
Organizations using Citrix NetScaler products should be aware of the potential risks associated with this vulnerability. Several configurations are particularly vulnerable.
- Citrix NetScaler ADC and Gateway versions 13.1 and 14.1.
- Configurations utilizing IPv6 services or service groups.
- Users relying on VPN functionalities or remote desktop proxy services.
What to do
Organizations are urged to assess their Citrix NetScaler deployments and apply necessary mitigations to reduce exposure to this vulnerability. Regular updates and patches should be prioritized.
- Review and update to the latest Citrix NetScaler versions.
- Implement security best practices for network configurations.
- Monitor for unusual activity that may indicate exploitation attempts.