Citrix NetScaler ADC and Gateway contain a memory overflow flaw (CWE‑119) that can be triggered by malformed input. The CVE description indicates that this overflow allows an attacker to execute arbitrary code or crash the system, potentially enabling remote code execution or denial of service. While the official advisory does not explicitly state that authentication is required, the fact that the flaw is triggered by external data leads to the inference that an unauthenticated attacker may exploit it without prior credentials.

The vulnerability affects Citrix NetScaler ADC versions prior to 14.1‑73.37, 13.1‑64.23, 14.1‑73.37 FIPS, and 13.1‑37.279 FIPS and NDcPP. It also affects Citrix NetScaler Gateway versions before 14.1‑73.37 and before 13.1‑64.23. All older releases listed in the Citrix advisory are susceptible.

With a CVSS score of 9.5 the vulnerability is classified as Critical. The EPSS score of 1% indicates a low but non‑zero likelihood that an exploit is actively used in the wild, and the KEV listing confirms that it has been identified as a known exploited vulnerability. The attack vector is inferred to be remote, reachable over the network, and could be exercised by sending crafted data to the appliance. This inference is based on the fact that the overflow is triggered during processing of external input, as described in the advisory. An attacker who can reach the vulnerable ports therefore could potentially gain full control of the device or cause it to terminate, affecting confidentiality, integrity, and availability.