An Out‑of‑Bounds Read vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a nearby low‑privilege attacker to read a limited portion of rpd memory and to disrupt an LDP adjacency via a malformed IPv6 LDP message. The disclosed memory can contain sensitive data, leading to potential exposure of cryptographic keys or configuration information. The disruption of an LDP adjacency can degrade routing stability or cause routes to fail, impacting network availability for connected peers.

Juniper Networks products Junos OS and Junos OS Evolved are affected. Only releases that precede the patched versions listed—23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1—remain vulnerable. Subsequent releases, including all listed patched releases and later versions, are considered fixed. The same applies to Junos OS Evolved releases prior to the patched revisions such as 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, plus all newer releases that incorporate these fixes.

The CVSS score of 5.3 indicates moderate severity. No EPSS data is available, so the exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread public exploitation yet. Attackers would need proximity to the device and ability to send crafted IPv6 LDP messages; the local nature of the exploit limits the threat surface but still poses a risk of data leakage and routing disruption for the affected device.