Insufficient input validation in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway when configured as a SAML Identity Provider allows attackers to trigger a memory overread. The flaw can expose raw memory contents or other sensitive information when crafted requests are sent to the appliance. The weakness is classified as CWE-125: Out‑of‑Bounds Read. The description does not explicitly state that code execution is possible, so the primary risk is data disclosure.

Citrix NetScaler Application Delivery Controller and Citrix NetScaler Gateway are affected. The vulnerability manifests only when these appliances are configured as SAML IDPs. Version information is not provided, so all builds supporting the SAML IDP configuration path are potentially vulnerable.

The CVSS score of 9.3 indicates high severity, and the EPSS score of 37% suggests a moderate to high likelihood of exploitation. The vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, meaning that exploits are observed or reported. The attack vector is inferred to be remote over the network, requiring the ability to send crafted SAML requests to the appliance. No local or physical prerequisites are indicated in the description.