A stack‑based buffer overflow exists in the routing protocol daemon (rpd) of Juniper networks Junos OS and its evolved variant. A peer that has been configured to participate in BGP/EVPN can send a specially crafted EVPN‑VPWS route advertisement that overflows the stack. On Junos OS this overflow grants the attacker root privileges, allowing arbitrary code execution. On Junos OS Evolved the same overflow results in an rpd crash, causing a denial‑of‑service condition. The weakness is a classic CWE‑121 vulnerability.

The affected products are Juniper Networks Junos OS and Junos OS Evolved. Affected releases include Junos OS: all releases beginning with 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and any subsequent release. For Junos OS Evolved, the remedy starts with 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO, and every release after that.

The CVSS score of 9.3 marks this flaw as a critical vulnerability and the EPSS score is not reported, indicating limited publicly available exploit data at this time. The flaw is not listed in the CISA KEV catalog, so no documented mass exploitation is known. The attack requires a BGP/EVPN peer that can send route updates, thereby needing network access to the router. When an attacker can create or manipulate such a peer, they can achieve root code execution on Junos OS or force a service crash on the evolved version, compromising confidentiality, integrity, and availability of the affected device.