The vulnerability is a NULL Pointer Dereference in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. When a configured BGP neighbor sends a route update, the daemon crashes if the device has routing‑policy resolution‑map and policy event‑tracing enabled. This crash results in a denial of service that can disrupt routing services and potentially cause packet loss or routing instability. The weakness corresponds to CWE‑476.

Affected systems are Juniper Networks Junos OS and Junos OS Evolved. Devices running any release before the patches listed in the advisory are vulnerable. Versions that need updating include Junos OS releases 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and subsequent releases, as well as the identical list for Junos OS Evolved releases such as 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and later.

The advisory lists a CVSS score of 8.7, indicating high severity. EPSS is not available, so current exploitation probability is unknown, but the lack of an EPSS score does not imply low risk. The vulnerability is not cataloged in CISA KEV, yet the crash could be leveraged by a malicious BGP neighbor that is authenticated and correctly configured. Because the exploit requires an attacker to have control or influence over an authenticated BGP neighbor and the specific policy configuration, the attack surface is limited to network operators who allow such neighbors. Nonetheless, a successful exploit would cause an immediate denial of service in the routing daemon.