An Integer Underflow flaw in the Juniper Networks Junos OS kernel allows an unauthenticated, network‑based attacker to trigger a kernel crash when the device processes malformed Extended Echo requests while the feature is enabled. The crash forces the routing engine to reboot, resulting in a denial of service. This vulnerability is classified as CWE‑191, indicating an integer calculation error.

The flaw affects Juniper Networks’ Junos OS on systems running any release before the patched versions listed in the vendor advisory. The fix is included in releases 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and any subsequent Junos OS releases. Devices using older releases that do not contain these respins remain vulnerable.

The CVSS score of 9.3 signals a critical severity, while the EPSS score of 0.0047 indicates a low but nonzero likelihood of exploitation. The vulnerability is not yet listed in the CISA KEV catalog, yet the lack of authentication requirements and the simplicity of sending a crafted packet over the network give an attacker a high likelihood of success. Exploitation requires the Extended Echo feature to be enabled and the device's kernel to process the malformed packet, which can be achieved from any remote location with network connectivity to the router.