Skip to content
OpenAdvisories
Critical · 9.2 Known exploited Public exploit CVE-2025-7775 EUVD-2025-25838GHSA-2m4h-vp37-6746

Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service

Published Aug 26, 2025 · Updated Feb 26, 2026 · Assigned by Citrix

Vendor: NetScaler Product: ADC Product: Gateway

Description

Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server

(OR)

NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or servicegroups bound with IPv6 servers

(OR)

NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with DBS IPv6 services or servicegroups bound with IPv6 DBS servers

(OR)

CR virtual server with type HDX

Affected products

VendorProductAffectedFixed
NetScaler ADC 14.1 – < 47.48, 13.1 – < 59.22, 13.1 FIPS and NDcPP – < 37.241, 12.1 FIPS and NDcPP – < 55.330 47.48
NetScaler Gateway 14.1 – < 47.48, 13.1 – < 59.22, 13.1 FIPS and NDcPP – < 37.241, 12.1 FIPS and NDcPP – < 55.330 47.48

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 4 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 2

References