The vulnerability is an improper validation of a specified quantity in input to the l2ald process in Juniper Networks Junos OS and Junos OS Evolved. Malformed ICCP packets containing unexpected or oversized fields can cause the l2ald daemon to disclose portions of memory and become unstable, which results in a denial of service and loss of Layer 2 connectivity.

Affected products are Juniper Networks Junos OS and Junos OS Evolved. The advisory lists a range of affected releases, including Junos OS 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all later releases; Junos OS Evolved 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and any subsequent releases.

The CVSS score of 5.3 classifies the bug as a moderate severity issue. The EPSS score is < 1 %, indicating a very low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves an adjacent attacker who can establish or participate in an ICCP peer session on the same network or virtual network segment. By sending specially crafted ICCP packets, an attacker can trigger memory disclosure and cause the l2ald daemon to crash, leading to disruption of Layer 2 connectivity.