Citrix NetScaler ADC and Citrix NetScaler Gateway contain a memory overflow flaw that leads to unpredictable or erroneous behavior, including crashes and denial of service. The vulnerability arises from improper handling of input that exceeds allocated buffer boundaries, resulting in a buffer overrun that can destabilize the affected systems.

The flaw affects Citrix NetScaler ADC software versions prior to 14.1‑73.37 and 13.1‑64.23, as well as prior to 14.1‑73.37 FIPS, 13.1‑37.279 FIPS, and NDcPP variants. It also impacts Citrix NetScaler Gateway firmware before 14.1‑73.37 and before 13.1‑64.23.

The CVSS score of 8.8 indicates high severity, while the EPSS score of <1% suggests a low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Because Citrix NetScaler ADC and Gateway are network‑exposed, it is reasonable to infer that an attacker could craft traffic remotely to trigger the memory overflow, leading to service crashes or denial of service. No evidence of arbitrary code execution is disclosed in the description.