The vulnerability is an integer underflow (CWE-191) in the rpd process of Juniper Networks Junos OS and Junos OS Evolved on ACX Series that allows an unauthenticated adjacent attacker to send malformed Rosen-MVPN messages and trigger a heap memory disclosure as well as multicast join-state injection. The flaw is limited to devices that support the draft Rosen MVPN feature, such as the ACX, EX, and MX Series.

Affected systems are Juniper Networks Junos OS and Junos OS Evolved running the listed patched releases for the ACX, EX, and MX Series. This includes Junos OS Evolved on ACX Series devices. Upstream releases that support Rosen-MVPN are mitigated by the following series of updates: for Junos OS 23.2R2-S7.7 up through 26.4R1 and for Junos OS Evolved 23.2R2-S7.7-EVO up through 26.4R1-EVO and all subsequent releases. Devices on older releases that include the Rosen-MVPN feature remain vulnerable.

The CVSS score of 5.3 indicates a moderate level of risk, and the EPSS score is not available, suggesting no publicly known or widespread exploitation yet. The vulnerability is not listed in CISA's KEV catalog, implying limited known exploitation at this time. The attack vector, identified as an unauthenticated adjacent attacker, requires proximity to the target device and the ability to transmit Rosen-MVPN packets. If exploited, the attacker could obtain locally stored routing information through the heap disclosure or manipulate multicast join state, potentially disrupting traffic routing within the local network.