A NULL Pointer Dereference in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to trigger a crash when it sends a BGP UPDATE message while ISO‑VPN and egress‑protection are enabled. The crash causes a denial of service, rendering the router unavailable until a reboot or watchdog restoration. The impact is full outage of routing services for the affected device.

The vulnerability affects Juniper Networks Junos OS and Junos OS Evolved. All releases listed as affected are – Junos OS 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and every subsequent release; and the analogous Junos OS Evolved releases 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO, and all later releases.

The CVSS score of 8.7 indicates a high‑severity denial‑of‑service flaw. The EPSS score of 0.46% indicates a very low, but non‑zero, likelihood of exploitation, yet the vulnerability can be invoked by simply sending a crafted BGP UPDATE from an unauthenticated peer, making exploitation likely in networks that employ ISO‑VPN egress protection. The flaw is not listed in CISA’s KEV catalog, yet its impact and the ease of triggering it over the network raise the overall risk for affected routers.