A heap-based buffer overflow in the eventd process of Juniper Networks Junos OS and Junos OS Evolved allows an unprivileged local user to send crafted IPC event messages that trigger the flaw. The overflow can be abused to crash the eventd daemon, resulting in a denial of service, or to elevate privileges to the root user, providing full control over the device. This weakness is identified as CWE-122.

All platforms running Juniper Networks Junos OS or Junos OS Evolved are affected. The vulnerability exists across the following released versions: Junos OS 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and all subsequent releases; and Junos OS Evolved 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO, and all subsequent releases. Special respins are available for earlier 23.2, 23.4, and 24.2 releases as noted by the vendor.

The CVSS score of 8.6 indicates high severity, and the exploit probability (EPSS) is not available, though the flaw can be leveraged locally. Because the attacker requires local access and can exploit the overflow to crash eventd or gain root, the risk is significant for systems without the applied patches. The vulnerability is not listed in CISA’s KEV catalog, but the impact remains serious due to the privilege escalation potential.