An improper validation of consistency within input in the routing protocol daemon (rpd) allows a misbehaving network‑adjacent BGP peer to send a specifically malformed BGP MCAST‑TREE update. When rpd attempts to readvertise the malformed NLRI, it crashes, causing a denial of service against the router. The flaw does not expose confidential data or modify configuration; its primary effect is to disrupt routing services and connectivity.

Juniper Networks Junos OS and Junos OS Evolved. The vulnerability affects the following Junos OS releases: 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all subsequent releases; and Junos OS Evolved releases: 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all subsequent releases.

The CVSS score of 8.7 indicates a high impact if successfully exploited. The EPSS score of < 1 % indicates a very low likelihood of exploitation currently. The vulnerability is not listed in CISA’s KEV catalog. The flaw requires a BGP neighbor that can send a malicious MCAST‑TREE NLRI, so an attacker would need network adjacency or control over a configured BGP peer. If gained, the attack can bring the router down, leading to loss of routing service for the network. Because the attack vector is limited to network‑adjacent peers, the exploitation risk is moderate‑high for systems that run BGP and are not isolated from untrusted peers.