Inside the Citrix NetScaler Exploit: From a DTLS Packet to Root-Level Code

Cybersecurity researchers have disclosed technical details of a recently patched critical flaw in Citrix NetScaler ADC and Gateway that is already under active exploitation.

Tracked as CVE-2026-88772 with a CVSS score of 9.5, the vulnerability is described as a memory overflow in the handling of the DTLS (Datagram Transport Layer Security) protocol, rooted in the NetScaler Packet Processing Engine (NSPPE). According to the U.S. agency CISA, it is an improper restriction of operations within the bounds of a memory buffer that could allow remote code execution or denial of service.

What goes wrong

As the firm watchTowr explains, NetScaler implicitly trusts the fragment_length value in the DTLS handshake header — which can be as little as one byte — even though the length field in the same header claims the complete message is 120 bytes long. This parsing inconsistency lets an attacker craft a malicious record that looks tiny while the data actually copied into the buffer is far larger.

Researcher Sina Kheirkhah illustrates it neatly: a 120-byte handshake message can arrive as 120 fragments. Every fragment carries length=120, but each one sets fragment_length=1, with offsets running from 0 up to 119. Once every position has arrived, the server considers the message complete. Stitching the pieces together is called reassembly.

How it becomes an overflow

Each received 1,459-byte packet is stored in NetScaler Buffers (NSBs), then stitched into a single scratch buffer of only 35,840 bytes. The vulnerable version never checks whether the next packet will fit, so data is written past the end of the buffer. As Kheirkhah puts it, the malicious records tell the reassembly code that each record supplies just one byte of a 120-byte message, yet NSPPE keeps almost the entire record in an NSB. After 120 records the message is deemed complete — but its NSB chain holds around 174 KB of data.

watchTowr's analysis shows this overflow can be steered into executing arbitrary shellcode with root privileges, using the mprotect() system call to defeat NX (no-execute) protections.

The writeup landed a day after the same firm released a proof-of-concept for the related CVE-2026-88771, which has been abused alongside CVE-2026-88772 in real-world attacks.

Source: The Hacker News