CVE-2024-8534: Memory safety vulnerability leading to memory corruption and Denial of Service

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-12 · updated 2026-06-17
Weakness: CWE-119

Description

Memory safety vulnerability leading to memory corruption and Denial of Service in NetScaler ADC and Gateway if the appliance must be configured as a Gateway (VPN Vserver) with RDP Feature enabled OR the appliance must be configured as a Gateway (VPN Vserver) and RDP Proxy Server Profile is created and set to Gateway (VPN Vserver) OR the appliance must be configured as a Auth Server (AAA Vserver) with RDP Feature enabled

Affected products

Citrix NetScaler ADC: from 12.1 before 13.1-55.34; from 14.1 before 14.1-29.72 — fixed in 13.1-55.34, 14.1-29.72
Citrix Netscaler Application Delivery Controller Fips: from 12.1 before 12.1-55.321; from 13.1 before 13.1-37.207 — fixed in 12.1-55.321, 13.1-37.207
Citrix Netscaler Application Delivery Controller Ndcpp: from 12.1 before 12.1-55.321 — fixed in 12.1-55.321
Citrix NetScaler Gateway: from 12.1 before 13.1-55.34; from 14.1 before 14.1-29.72 — fixed in 13.1-55.34, 14.1-29.72
Netscaler Adc: from 14.1 before 14.1-29.72 — fixed in 14.1-29.72
Netscaler Gateway: from 14.1 before 14.1-29.72 — fixed in 14.1-29.72
Netscaler-Adc 12.1-Fips: from 12.1 before 12.1-55.321 — fixed in 12.1-55.321
Netscaler-Adc 12.1-Ndcpp: from 12.1 before 12.1-55.321 — fixed in 12.1-55.321
Netscaler-Adc 13.1-Fips: from 13.1 before 13.1-37.207 — fixed in 13.1-37.207
Citrix NetScaler Gateway: from 14.1 before 29.72; from 13.1 before 55.34; from 13.1-FIPS before 37.207; from 12.1-FIPS before 55.321; from 12.1-NDcPP before 55.321 — fixed in 29.72, 55.34, 37.207, 55.321
NetSclaer NetScaler ADC: from 14.1 before 29.72; from 13.1 before 55.34; from 13.1-FIPS before 37.207; from 12.1-FIPS before 55.321; from 12.1-NDcPP before 55.321 — fixed in 29.72, 55.34, 37.207, 55.321

How to fix

Upgrade to a fixed version: Citrix NetScaler ADC 13.1-55.34, 14.1-29.72; Citrix Netscaler Application Delivery Controller Fips 12.1-55.321, 13.1-37.207; Citrix Netscaler Application Delivery Controller Ndcpp 12.1-55.321; Citrix NetScaler Gateway 13.1-55.34, 14.1-29.72; Netscaler Adc 14.1-29.72; Netscaler Gateway 14.1-29.72; Netscaler-Adc 12.1-Fips 12.1-55.321; Netscaler-Adc 12.1-Ndcpp 12.1-55.321; Netscaler-Adc 13.1-Fips 13.1-37.207; Citrix NetScaler Gateway 29.72, 55.34, 37.207, 55.321; NetSclaer NetScaler ADC 29.72, 55.34, 37.207, 55.321. Check the vendor advisory for mitigations.

References

https://support.citrix.com/s/article/CTX691608-netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20248534-and-cve20248535?language=en_US

Get alerted when CVE-2024-8534 or the next vulnerability affects your stack