An integer underflow (CWE-191) in the rpd process of Juniper Networks Junos OS on EX Series and MX Series and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to send malformed Rosen-MVPN messages and trigger a heap memory disclosure as well as multicast join‑state injection.

The vulnerability affects Juniper Networks Junos OS and Junos OS Evolved running on EX Series, MX Series, and ACX Series devices that support draft Rosen MVPN. Devices with releases before the patched series—Junos OS 23.2R2‑S7.7 through 26.4R1 and Junos OS Evolved 23.2R2‑S7.7‑EVO through 26.4R1‑EVO—remain vulnerable.

The CVSS score of 5.3 represents moderate risk, while the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog, suggesting no known widespread exploitation. The likely attack vector is an unauthenticated adjacent attacker able to transmit Rosen‑MVPN packets; exploitation would result in sensitive routing data being disclosed from heap memory or manipulation of multicast join state.