CVE-2025-7776
Published: 26 August 2025
Summary
CVE-2025-7776 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Citrix Netscaler Application Delivery Controller. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-7776 is a memory overflow vulnerability (CWE-119) affecting NetScaler ADC and NetScaler Gateway. The issue arises specifically when NetScaler is configured as a Gateway, including VPN virtual server, ICA Proxy, CVPN, or RDP Proxy configurations with a PCoIP Profile bound to it. This flaw can lead to unpredictable or erroneous behavior as well as Denial of Service conditions. It has a CVSS v3.1 base score of 9.8, reflecting its critical severity.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, enabling attackers to cause denial of service or potentially execute arbitrary code due to the memory overflow.
For mitigation details, refer to the Citrix advisory at https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-25901
Vulnerability details
Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) with PCoIP Profile bounded to it
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Memory overflow in public-facing NetScaler Gateway enables remote unauthenticated exploitation for RCE or DoS, directly mapping to exploitation of internet-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 mandates identification, reporting, and correction of system flaws like the memory overflow in CVE-2025-7776 through timely patching as per vendor advisories.
SI-16 implements memory protection mechanisms such as address space layout randomization and non-executable memory to prevent exploitation of the memory overflow vulnerability.
SI-10 enforces validation of information inputs, preventing malformed PCoIP traffic from triggering the memory overflow in NetScaler Gateway configurations.