The vulnerability is a NULL pointer dereference in the routing protocol daemon (rpd). Sending a specially crafted BGP packet from an eBGP peer while the device is using interim or non‑persistent configuration causes rpd to crash and persistently deny routing services. The crash destroys routing state, potentially disconnecting the device from the network and disrupting all peers that rely on its routes.

This flaw affects Juniper Networks Junos OS and Junos OS Evolved. All releases prior to the fix releases listed in the official solution – for example, Junos OS 23.2 through 26.4R1 and Junos OS Evolved 23.2 through 26.4R1 – are vulnerable. The advisory specifies update paths for each major release series, covering millions of routers and switches that run these operating systems.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is 0.0046, indicating a very low exploitation probability. Based on the description, the vulnerability is primarily exploitable by a BGP peer, i.e., a remote host that can be configured as a neighbor. An attacker who can send the specific packet can force the routing daemon to crash, resulting in a denial of routing services until the daemon is restored. The flaw is not listed as a known exploited vulnerability in CISA’s KEV list, but the impact on service continuity can be significant in high‑availability environments.