An integer overflow or wraparound can be triggered by specially crafted EVPN route updates received by the routing protocol daemon (rpd). If successfully exploited the daemon may crash, preventing the router from performing routing functions and causing a denial of service. The flaw arises from improper bounds checking on integer values used to track EVPN route information, classified as CWE‑190.

The vulnerability is present in Juniper Networks Junos OS and Junos OS Evolved. Affected versions include Junos OS releases 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all newer releases, as well as the corresponding Junos OS Evolved releases 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and later.

The CVSS score of 8.7 indicates high severity, and the EPSS score of 0.0046 (< 1%) reflects a very low exploitation probability. Nevertheless the vulnerability remains remotely exploitable over the network via a valid EVPN BGP session. The KEV status shows it is not yet listed in CISA’s Known Exploited Vulnerabilities catalog, and no workaround exists, so any device with an accepted EVPN peer is potentially at risk. The flaw is a classic integer overflow (CWE‑190), which, if triggered, can crash the routing protocol daemon and halt routing services on the device.