---
id: "CVE-2026-111337"
page: "https://infrastack.ai/live/CVE-2026-111337"
kind: "vulnerability"
aliases: ["CVE-2026-111337"]
title: "Citrix NetScaler: Base64 decoding overflow in policy expressions crashes or misbehaves"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "NetScaler ADC", "fixed": ["14.1-73.57"], "affected": "< 14.1-73.57", "ecosystem": "vendor"}, {"name": "NetScaler Gateway", "fixed": ["14.1-73.57"], "affected": "< 14.1-73.57", "ecosystem": "vendor"}]
ecosystems: []
tags: ["citrix", "denial-of-service", "infrastructure", "netscaler", "netscaler-gateway", "self-hosted"]
not_affected_if: ["no-appfw", "no-b64decode-policy"]
published_at: "2026-11-13T08:17:15+00:00"
first_seen_at: "2026-11-13T08:44:23+00:00"
updated_at: "2026-11-13T08:47:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111337", "first_seen_at": "2026-11-13T08:44:23+00:00"}, {"source": "analyst", "url": "https://support.citrix.com/external/article/CTX697305", "first_seen_at": "2026-11-13T08:47:13+00:00", "cites": ["https://support.citrix.com/external/article/CTX697305"]}]
exploit_sources: []
---

# Citrix NetScaler: Base64 decoding overflow in policy expressions crashes or misbehaves

Link for people: https://infrastack.ai/live/CVE-2026-111337 (this .md is for agents)

A memory overflow in how Citrix NetScaler ADC and NetScaler Gateway decode Base64 inside advanced policy expressions can cause erratic behavior or a denial of service. The sources do not state that an attacker can run code or read data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NetScaler ADC affected < 14.1-73.57 fixed 14.1-73.57
- vendor:NetScaler Gateway affected < 14.1-73.57 fixed 14.1-73.57

## How to check

Exposed only if a policy containing the B64DECODE advanced-policy-expression operator is bound globally or to a virtual server of any type, and/or an Application Firewall (AppFW) is configured (Citrix's stated precondition). Search the running config (show running config) for B64DECODE and for AppFW bindings, and check the version with 'show version'. Citrix lists affected builds as before 14.1-73.57, 13.1-64.39, 14.1-FIPS 14.1-73.58, 13.1-FIPS/NDcPP 13.1-37.293 (taken from a mirror of the bulletin, not read on Citrix's page). Note the bulletin's ID for this row differs between renderings (CVE-2026-111337 vs CVE-2026-111347); the NVD id matches 111337.

## Fix

Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later (14.1); 13.1-64.39 or later (13.1); 14.1-FIPS 14.1-73.58 FIPS or later; 13.1-FIPS and 13.1-NDcPP 13.1-37.293 or later.

## Timeline

- 2026-11-13T08:44:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111337
- 2026-11-13T08:47:13+00:00 analyst https://support.citrix.com/external/article/CTX697305 — Citrix CTX697305 read: precondition B64DECODE policy bound and/or AppFW, heap overflow CWE-122, CVSS4 8.7, fixed builds listed. Affected-range lower bounds (13.1 < 13.1-64.39 etc.) from mirror only; 13.1 and FIPS rows not stored as products. Row ID differs between two fetches of the bulletin (111337 vs 111347); check against the live page. No exploitation or PoC found; X/social not searched. Only the fix field marked verified.

## Documents

- [advisory] Citrix NetScaler ADC and Gateway Security Bulletin CTX697305 https://support.citrix.com/external/article/CTX697305

## From the sources

Memory overflow in Base64 decoding in advanced policy expressions leading to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_