The vulnerability is a classic buffer overflow in the Advanced Forwarding Toolkit (evo-aftmand/evo-pfemand) of Juniper Networks Junos OS Evolved. An unauthenticated attacker can send specially crafted multicast packets to crash the line card processes or non‑line‑card devices. The crash causes the affected services to restart, and continued delivery of these packets results in a sustained denial‑of‑service condition for the affected device. The weakness is characterized as a buffer copy without size checking (CWE‑120).

Vendors impacted are Juniper Networks, with the product Junos OS Evolved for both PTX Series and QFX5000 Series line cards. The affected release ranges include all PTX Series releases prior to 22.4R3‑S8‑EVO, 23.2R2‑S5‑EVO, 23.4R2‑EVO, 24.2R2‑EVO, and 24.4R2‑EVO, as well as QFX5000 Series releases before 22.2R3‑S7‑EVO, 22.4R3‑S7‑EVO, 23.2R2‑S4‑EVO, 23.4R2‑S5‑EVO, 24.2R2‑S1‑EVO, and 24.4R1‑S3‑EVO. Versions earlier than the listed ones are unaffected.

The CVSS base score of 7.1 reflects a high impact DoS vulnerability that requires no authentication but does require the attacker to be on the same broadcast domain to inject multicast traffic. EPSS data is unavailable, and the vulnerability is not currently listed in the CISA KEV catalog. Because there is no workaround, the risk is contingent upon the ability of attackers to reach the target network and persistently send malicious packets; the impact can be significant for critical services if left unpatched.