A heap-based buffer overflow in the eventd process of Juniper Networks Junos OS and Junos OS Evolved allows an unprivileged local user to send crafted IPC event messages that trigger the flaw. The overflow can be abused to crash the eventd daemon, resulting in a denial of service, or to elevate privileges to the root user, providing full control over the device. This weakness is identified as CWE-122.

All platforms running Juniper Networks Junos OS or Junos OS Evolved are affected. The vulnerability exists across the following released versions: Junos OS 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and all subsequent releases; and Junos OS Evolved 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO, and all subsequent releases. Special respins are available for earlier 23.2, 23.4, and 24.2 releases as noted by the vendor.

The CVSS score of 8.6 indicates high severity, and the exploit probability (EPSS) is <1%, reflecting very low but nonzero exploitation likelihood. The flaw can be leveraged locally; the attacker needs local access and can exploit the overflow to crash eventd or gain root. The vulnerability is not listed in CISA’s KEV catalog, but the potential for privilege escalation remains a serious concern for unpatched systems.