A remote attacker with an established EVPN BGP peering relationship can trigger an integer overflow or wraparound in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. The flaw allows the attacker to cause a denial of service by disrupting control‑plane adjacencies and potentially dropping or misrouting traffic. The vulnerability is remote in nature and does not require local privileges.

The issue impacts Juniper Networks Junos OS and Junos OS Evolved. Vulnerable by default release versions include 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases for Junos OS. For Junos OS Evolved, susceptible releases are 23.2R2-S7.7‑EVO, 23.4R2-S8.11‑EVO, 24.2R2-S5.6‑EVO, 24.4R2-S5‑EVO, 25.2R2-S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1-S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1-S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO, and all subsequent releases. Specific respins for 23.2, 23.4, and 24.2 (and their EVO equivalents) address earlier builds.

The advisory assigns a CVSS score of 8.7, indicating a high severity risk. No EPSS score is published, and the vulnerability is not listed in CISA’s KEV catalog. Given the remote nature of the attack and the requirement for an established EVPN BGP peering, a knowledgeable attacker could exploit this flaw from the network side, especially targeting untrusted peers. The lack of a publicly known workaround means updates are the only effective defense.