Finding the NetScaler SAML Crash in nsaaad

Sat, 03 Oct 2026 14:33:25 +0200

NetScaler’s SAML problem led me into nsaaad, the authentication daemon. In build 14.1-73.30, a routine identified by embedded source strings as canonicalize_data puts namespace-prefix pointers into a sixteen-entry stack array. It accepts sixteen entries, but the code that consumes them expects a NULL terminator. There is no room for that terminator when the array is full.

The next pointer read comes from the saved stack canary. The diagnostic code treats it as a string pointer, and the controlled test ended in strlen with SIGBUS, a core, and one Pitboss restart of nsaaad.

That test started at the daemon’s internal message boundary. The disposable appliance had no AAA licence, so I could not reproduce delivery through a network-facing Gateway or AAA SAML virtual server. The static path reaches the same operation, but the external route remains untested locally. The observed impact is one daemon crash and restart; the run did not establish code execution, restart exhaustion, or an appliance reboot.

CVE-2026-88779 on Martin's Blog

Finding the NetScaler SAML Crash in nsaaad