The vulnerability is an improper handling of length parameter inconsistency in the routing protocol daemon. An attacker can craft a malformed BGP EVPN multicast update that, when the daemon attempts to readvertise it, overwrites memory and triggers a crash. This causes a temporary denial of service on the affected device as the daemon must restart, disrupting routing control and potentially cascading to wider service outages.

Affected vendors are Juniper Networks. Products: Junos OS and Junos OS Evolved. Versions impacted include all releases prior to the updates listed in the solution, such as 23.2, 23.4, 24.2, 25.2, 25.4, 26.2, 26.4 and their equivalent Evolved releases down through 25.4X300-D40-EVO. The advisory lists specific respins for certain releases, but all earlier non‑patched builds are affected.

The CVSS score of 8.7 marks this as a high‑severity vulnerability. The EPSS score is not available, so the current probability of exploitation cannot be quantified, and it is not listed in the CISA KEV catalog. The attack requires sending a crafted BGP EVPN multicast update over the network to the target device. An attacker with network access to the routing session can trigger the crash, causing a denial of service without compromising confidentiality or integrity. Because the flaw lies in length parameter handling, the exact conditions for exploitation are not fully described, but the impact is clear.