An integer overflow or wraparound can be triggered by specially crafted EVPN route updates received by the routing protocol daemon (rpd). If successfully exploited the daemon may crash, preventing the router from performing routing functions and causing a denial of service. The flaw arises from improper bounds checking on integer values used to track EVPN route information, classified as CWE‑190.

The vulnerability is present in Juniper Networks Junos OS and Junos OS Evolved. Affected versions include Junos OS releases 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all newer releases, as well as the corresponding Junos OS Evolved releases 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and later.

The CVSS score of 8.7 indicates high severity, and the lack of an available EPSS score does not preclude exploitation; the vulnerability is remotely exploitable over the network via a valid EVPN BGP session. The KEV status shows it is not yet listed in CISA’s Known Exploited Vulnerabilities catalog, but the lack of a workaround means that any exposed device with an accepted EVPN peer is potentially at risk. The flaw is a classic integer overflow (CWE‑190), which, if triggered, can crash the routing protocol daemon and halt routing services on the device.