This vulnerability arises from insufficient input validation in NetScaler ADC and Gateway products when the TCP TimeStamp feature is enabled in the TCP Profile linked to virtual servers of type Load Balancer (LB), Content Switching (CS), VPN, or associated services. This flaw leads to an out-of-bounds memory read condition (CWE-125), which may expose sensitive memory contents or cause application instability. The CVSS 4.0 base score is 6.9, indicating a medium severity level. The vulnerability affects exactly versions 13.1 and 14.1 of NetScaler ADC. There is no vendor advisory indicating an available patch or workaround at this time.

The vulnerability allows an attacker to cause an out-of-bounds read in memory, potentially leading to information disclosure or application instability. However, there is no indication of privilege escalation, remote code execution, or denial of service. The attack vector is network-based with no privileges or user interaction required, but the impact is limited to partial memory disclosure or instability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the TCP TimeStamp option in TCP Profiles associated with virtual servers or services as a potential temporary mitigation if feasible. Monitor vendor communications for updates on patches or official workarounds.