A Heap-based Buffer Overflow in Juniper Networks Junos OS SRX Series' Secure Vector Routing component enables an unauthenticated attacker to send malformed IPv4 packets to a tuned interface, causing the packet-forwarding process to crash. This vulnerability is identified as CWE-122. The crash yields a denial of service, and the same flaw also risks compromising confidentiality and integrity of packet processing.

Affected systems include Juniper Networks Junos OS on SRX Series routers. The vulnerability is present in the software releases 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all later releases. Specific respins for 23.2, 23.4, and 24.2 have also been rebuilt to contain the fix.

The CVSS score of 9.3 marks this issue as critical, and the EPSS score of 0.00468 indicates an exploitation probability of less than 1%. While the likelihood of exploitation is low, the severity remains high because the vulnerability allows an unauthenticated attacker to crash the packet-forwarding process, disabling traffic handling and potentially facilitating further attacks on confidentiality and integrity. The flaw can be exploited remotely by an attacker who can reach a router interface with SVR enabled; the attack requires only the ability to transmit malformed IPv4 packets and does not need privileged access. Because the flaw exists in the packet-forwarding engine, a successful exploitation causes a crash that disables packet forwarding, possibly enabling the attacker to mount further attempts to compromise data confidentiality or integrity if they can observe or manipulate traffic. The vulnerability is not yet listed in CISA’s KEV catalog; however, patching remains recommended given the high CVSS score and the potential impact.