Quantum Secular Labs / Blog / Advisories

CVE-2025-5777: Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability

CVE-2025-5777 is rated critical with a CVSS v4.0 base score of 9.3 and affects Citrix NetScaler ADC and Gateway, along with 2 other products in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-07-10, which means exploitation in the wild has been observed.

Vulnerability description

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

Severity breakdown

CVSS v4.0 9.3: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

• Attack vector: Network. Exploitable remotely over the network.
• Attack complexity: Low. No special conditions; the attack can be repeated reliably.
• Attack requirements: None. No deployment or execution conditions are needed.
• Privileges required: None. No account or prior access is needed.
• User interaction: None. No action from any user is needed.
• Confidentiality impact (vulnerable system): High. Total loss of confidentiality.
• Integrity impact (vulnerable system): High. Total loss of integrity.
• Availability impact (vulnerable system): High. Total loss of availability.
• Confidentiality impact (subsequent systems): Low. Some information on other systems is exposed.
• Integrity impact (subsequent systems): Low. Some data on other systems can be modified.
• Availability impact (subsequent systems): Low. Reduced availability of other systems.

Underlying weakness

CWE-125: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

CWE-908: Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

Affected products

• Citrix Netscaler Application Delivery Controller: from 12.1 before 12.1-55.328; from 13.1 before 13.1-37.235; from 13.1 before 13.1-58.32; from 14.1 before 14.1-43.56
• Citrix Netscaler Gateway: from 13.1 before 13.1-58.32; from 14.1 before 14.1-43.56

References

• https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
• https://citrixbleed.com
• https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/
• https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/
• https://www.bleepingcomputer.com/news/security/cisa-tags-citrix-bleed-2-as-exploited-gives-agencies-a-day-to-patch/
• https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/
• https://doublepulsar.com/citrixbleed-2-exploitation-started-mid-june-how-to-spot-it-f3106392aa71
• https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5777
• https://www.theregister.com/2025/07/10/cisa_citrixbleed_kev/