The vulnerability is a Use After Free in the rpd PIM Join/Prune processing. An unauthenticated adjacent attacker can send specific PIM messages that crash the routing daemon, causing a denial of service on Junos OS and Junos OS Evolved. The crash prevents the routing process from functioning, potentially downing routing across the router until a restart.

Affected systems include Juniper Networks Junos OS and Junos OS Evolved platforms. The vulnerability applies to the following releases: Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases; Junos OS Evolved 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases.

The CVSS score of 7.1 indicates significant impact. EPSS is not available, so the statistical likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. Because it can be triggered by an unauthenticated attacker on an adjacent network, it is a local network threat. Exploitation would involve sending crafted PIM Join/Prune packets to a router with sparse mode PIM enabled, which causes the routing daemon to crash. A crash results in a loss of routing function until the daemon restarts, leading to network outages. The lack of a workaround and the availability of patched releases underscore the need for rapid remediation.