CVE-2025-7775

The vulnerability (CWE-119) consists of improper handling of memory buffer boundaries in several device configurations. The error occurs when NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, as well as when an HTTP, SSL, or HTTP_QUIC load balancing virtual server is associated with IPv6 services or IPv6 service groups (including DBS). An additional attack vector concerns CR virtual server with HDX type. Buffer overflow in these network traffic processing paths can lead to writing data outside the allocated memory area, which an attacker can exploit to hijack control of the execution flow.

A remote, unauthenticated attacker may be able to achieve arbitrary code execution on the vulnerable device (RCE) or cause its complete unavailability through process crash (DoS), which in the case of VPN/Gateway devices may result in disruption of remote access for the entire organization.

Security patches available from the vendor must be applied according to references — Citrix security bulletin CTX694938 (https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938). Due to active exploitation of the vulnerability in production environments (CISA KEV), the update should be deployed immediately. Until patching is completed, consider restricting access to management interfaces and monitoring for anomalies in network traffic on NetScaler devices.

Citrix NetScaler ADC and NetScaler Gateway in versions 13.1, 14.1, 13.1-FIPS and NDcPP, configured as: Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy), AAA virtual server, LB virtual server type HTTP/SSL/HTTP_QUIC associated with IPv6 services or service groups (including IPv6 DBS), or CR virtual server with HDX type

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service.