An out‑of‑bounds write in Juniper’s routing protocol daemon (rpd) is triggered by a malformed BGP update sent by an eBGP neighbor that has not negotiated the four‑byte AS capability. The write corrupts memory, causing rpd to crash and the router to reboot or lose BGP operation. This leads to loss of routing information, packet forwarding interruption, and overall denial of for all traffic through the affected device.

The vulnerability affects Juniper Networks Junos OS and Junos OS Evolved. Junos OS releases starting with 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all subsequent releases are patched, as are the corresponding Junos OS Evolved releases 23.2R2‑S7.7‑EVO through 26.4R1‑EVO with their respins and rebuilds.

The vulnerability carries a CVSS score of 8.7, indicating a high severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog, suggesting it is not widely exploited yet, but the impact remains significant. The likely attack vector is remote: an attacker can become an eBGP peer that does not support four‑byte AS capability, inject the crafted update packet, and trigger the crash. No local privilege or authentication is required beyond establishing the BGP session, so the threat is realistic for attackers with route control or compromised neighbor devices.