A stack-based buffer overflow exists in the UTM Anti‑Spam Sender Browsing List (SBL) component of Juniper Networks Junos OS on SRX series routers. An unauthenticated remote attacker may send a malformed DNS packet to a device that has anti‑spam SBL inspection enabled, triggering the overflow and potentially allowing arbitrary code execution with the privileges of the operating system process or causing a denial of service.

The vulnerability affects Juniper Networks Junos OS running on SRX series routers. Affected releases include 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and all subsequent releases. For Junos OS releases 23.2, 23.4, and 24.2, specific respins have been referenced; previously published versions of these releases have been rebuilt to address the issue.

The CVSS base score of 9.2 classifies the flaw as critical, indicating a high potential for exploitation. The EPSS score is less than 1 %, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw remotely without any authentication, provided the device has UTM Anti‑Spam SBL inspection enabled. Since the failure leads to a buffer overflow, the attacker may achieve arbitrary code execution or a denial of service, elevating the risk above typical denial‑of‑service scenarios. No workaround is available, making patching the only viable mitigation.