CVE-2008-0356: Citrix Presentation Server IMA Service Buffer Overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS 2.0 base score of 10 and very high EPSS probability makes this a top remediation priority for any exposed Citrix deployment.

What it is

The Independent Management Architecture (IMA) service in Citrix Presentation Server 4.5 and earlier, Access Essentials 2.0 and earlier, and Desktop Server 1.0 contains a buffer overflow triggered by an invalid size value in a packet sent to TCP port 2512 or 2513. Because the flaw is remotely reachable without authentication and yields full code execution, it is a serious pre-auth risk to exposed Citrix infrastructure.

Impact

A remote attacker can execute arbitrary code with the privileges of the IMA service, typically SYSTEM, leading to full compromise of the Citrix server. From there an attacker could pivot into the hosted desktop or application environment.

Attack surface

Reachable over the network via TCP ports 2512 and 2513; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. Any host exposing the IMA service to untrusted networks is in scope.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high (0.72963, 99.4th percentile), indicating elevated likelihood of exploitation activity. References include a Zero Day Initiative advisory, suggesting coordinated disclosure of a working issue.

What to do

• Apply the Citrix patch referenced in support article CTX114487 as the first action.
• Restrict TCP ports 2512 and 2513 to trusted management networks using host and network firewalls.
• Do not expose IMA service ports to the internet; place Citrix servers behind segmented network controls.
• Upgrade or migrate off end-of-life versions (Presentation Server 4.5 and earlier, Access Essentials 2.0 and earlier, Desktop Server 1.0) where feasible.
• Monitor vendor advisories for any updated guidance on affected builds.

Detection

• Alert on inbound connections to TCP 2512 and 2513 from untrusted or unexpected source networks.
• Monitor IMA service process crashes or restarts, which can indicate malformed packet attempts.
• Inspect network traffic to those ports for oversized or malformed size fields in IMA packets.
• Correlate Citrix server logs with IDS/IPS signatures for buffer overflow attempts against the IMA service.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.