The vulnerability is an integer underflow in the srxpfe, allowing an unauthenticated attacker to trigger a forwarding‑plane denial of service by sending a crafted ICMP message linked to an SVR carrier session. This flaw can cause the SRX device to become unresponsive for traffic forwarding, but does not expose user data or provide remote code execution capabilities. The weakness is identified as CWE‑191.

Affected are Juniper Networks Junos OS and Junos OS Evolved running on SRX Series devices. The flaw applies to all current releases listed in the vendor advisory, including 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all later Junos OS releases, as well as the corresponding Junos OS Evolved releases 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all subsequent releases.

The CVSS score is 7.1, indicating a high severity. No EPSS score is available, but the flaw is not listed in CISA KEV, suggesting no known widespread exploitation yet. Attackers must send a specially crafted ICMP packet to a device via an SVR carrier session; authentication is not required. Because the impact is a denial of service, the risk to confidentiality and integrity is minimal, but the availability impact can be significant for network services depending on the SRX device.