https://mac.sploit.dk/tags/cve-2026-88772/Recent content in CVE-2026-88772 on Martin's BlogHugoen-usTue, 29 Sep 2026 12:00:00 +0200https://mac.sploit.dk/blog/cve-2026-88772-netscaler-dtls-memory-overflow/Tue, 29 Sep 2026 12:00:00 +0200https://mac.sploit.dk/blog/cve-2026-88772-netscaler-dtls-memory-overflow/<p>CVE-2026-88772 is a pre-authentication memory-overflow vulnerability in NetScaler ADC and NetScaler Gateway. Citrix says that it can lead to remote code execution or denial of service, requires DTLS to be enabled, and has been exploited in the wild.</p> <p>The public advisory tells operators what to do: upgrade to a fixed build. It does not show the vulnerable copy or explain what changed. A <a href="https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/">watchTowr analysis</a> fills in that gap with a detailed account of DTLS record processing, a patched binary comparison, debugger observations, and a working exploit chain.</p> <p>Comparing the local NetScaler 14.1 builds independently confirms the central root-cause claim. In build 73.30, the packet engine appends a linked chain of DTLS buffers to a fixed <code>0x8c00</code>-byte global scratch area without checking the cumulative length. In build 73.37, the corresponding function tracks the remaining capacity and rejects an element before the copy that would exceed it.</p> <p>That is strong static confirmation of the memory-corruption primitive and of the repair. It is not a local reproduction of a crash or remote code execution. No malicious packet was sent, DTLS was not enabled in the lab, and the public exploit was not run.</p>