A reachable assertion flaw in Juniper’s routing protocol daemon allows an attacker to cause an uncontrolled crash by sending a specially crafted LDP packet. The flaw enables the attacker to terminate the rpd without authentication, leading to a loss of routing function on the affected device and disrupting network traffic. The weakness is a classic assertion-based memory corruption, classified as CWE-617.

The vulnerability affects Juniper Networks Junos OS and Junos OS Evolved. All releases prior to or equal to the versions listed by Juniper – 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 for Junos OS and the corresponding Evolved releases – are impacted. No information is available for newer or custom-build releases beyond those enumerated; customers should verify their firmware against the vendor list.

The CVSS score for this issue is 7.1, indicating a high severity impact on availability. The EPSS score is not available, so the current probability of exploitation is unknown, but the flaw is listed as not in CISA’s KEV catalog. Based on the description and known attack patterns, the likely attack vector is a local or adjacent attacker who can establish or already has an LDP session with the target device. The attacker must send a crafted packet over that session; no public exploit has been published, yet the fundamental nature of the vulnerability suggests it could be leveraged by skilled adversaries within the same network domain.