The vulnerability is an improper handling of a length parameter inconsistency in the l2ald daemon, classified as CWE‑130. An attacker who can control or impersonate a configured MC‑LAG ICCP peer can send a malformed ICCP message that causes the daemon to read beyond the intended buffer boundaries. This can expose portions of the process heap containing sensitive configuration or credential data, or it can lead to a crash that disrupts the device’s layer‑2 control plane.

Affected systems are Juniper Networks Junos OS and Junos OS Evolved in a wide range of releases. For Junos OS, versions 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all later releases are affected, while for Junos OS Evolved the impacted releases include 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all subsequent releases. Earlier respins of 23.2, 23.4 and 24.2 versions, as well as the corresponding EVO releases, have been rebuilt to address the flaw.

The CVSS base score of 7.1 indicates a high severity. The EPSS score is < 1%, indicating a very low but nonzero likelihood of exploitation, but the lack of a KEV listing suggests no confirmed exploitation in the wild yet. The vulnerability can be exploited when an attacker can inject a crafted MC‑LAG ICCP packet toward the target device, typically from a peer in the same LAG or by spoofing a peer address. Successful exploitation can result in leakage of internal memory or a denial of service that would interrupt layer‑2 traffic handling.