CVE-2025-7775KEV · OVERDUECWE-119

Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service

Critical · published August 26, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.2. It is confirmed in active exploitation. It sits in the 97.5th percentile for exploit probability.

423
days past CISA
deadline
CVSS v4.0
9.2
EPSS
20%
Percentile
97.5
In the wild
Confirmed
What it is

🔥 A memory overflow vulnerability lurking in NetScaler ADC and Gateway is like a crowded highway suddenly buckling under the weight of too many vehicles, causing chaos! ⚠️ Imagine a nightclub where the bouncer lets in way too many guests; soon, there's a stampede, and the fire exits get blocked. That's what a memory overflow does—too much data push it to the brink, letting attackers take control. 🌪️ The consequences are absolutely devastating! An attacker could exploit this vulnerability to take over the system, execute harmful code, or even bring your entire service crashing down. This isn’t just a minor hiccup; it’s a potential disaster for any organization relying on these services! 🚨🔥

Put simply

Imagine a nightclub where the bouncer lets in way too many guests; soon, there's a stampede, and the fire exits get blocked. That's what a memory overflow does—too much data push it to the brink, letting attackers take control. 🌪️ This vulnerability in NetScaler ADC and Gateway allows for remote code execution and denial of service by exploiting a memory overflow condition in specific configurations where IPv6 services are used.

What to do

The consequences are absolutely devastating! An attacker could exploit this vulnerability to take over the system, execute harmful code, or even bring your entire service crashing down. This isn’t just a minor hiccup; it’s a potential disaster for any organization relying on these services! 🚨🔥 To mitigate this threat, patch your NetScaler ADC and Gateway to the latest versions immediately—13.1 or 14.1. Review your configurations to ensure they don't use vulnerable setups with IPv6 services. This is critical; don't delay! 🛡️ You’ve got this! Follow these steps, and you'll be back in the driver's seat, steering clear of potential disasters! 🚀

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
EPSS
0.20284 · 97.5th percentile
Weakness
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
Published
2025-08-26T12:56Z
KEV added
2025-08-26 · due 2025-08-28
EPSS history
Timeline
  • 26 AUG 12:56Z
    Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service
    cvelistv5
  • 26 AUG 00:00Z
    Added to CISA KEV — remediate by Aug 28
    kev