An out‑of‑bounds write in the routing protocol daemon (rpd) of Junos OS Evolved allows a malicious BGP peer to crash the daemon on QFX5240, QFX5241 and QFX5250 routers that are configured with BGP global‑load‑balancing and more than 128 ECMP next‑hops. The failure results in a denial of service because the rpd process terminates and the router becomes unable to forward traffic until it is restarted. The weakness is classified as CWE-787, indicating an unchecked index access that overflows a buffer.

The vulnerability affects Juniper Networks Junos OS Evolved routers running QFX5240, QFX5241, and QFX5250 models when BGP global‑load‑balancing is enabled. Software releases 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, and 26.2R1‑EVO, as well as all later releases, contain the fix. Earlier 23.2‑EVO, 23.4‑EVO, and 24.2‑EVO editions have associated respins that address the issue.

The CVSS score of 7.1 places the vulnerability in the medium severity range, although the EPSS score is 0.00269, indicating an extremely low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported. The likely attack vector involves an attacker who can establish or manipulate a BGP session with the affected router; by sending a carefully crafted BGP message the out‑of‑bounds write is triggered, leading to a daemon crash. Because there are no known workarounds, the risk remains high for any environment that relies on global‑load‑balancing with high ECMP counts until the patch is applied.