A NULL Pointer Dereference in the na-grpcd process allows an unauthenticated attacker with access to the chassis‑internal network to crash the service when the InitialSync service processes a message, resulting in a denial of service. The vulnerability manifests when the service is triggered via a specific network message and leads to the termination of na‑grpcd, causing interruption of normal device operation.

The vulnerability affects Juniper Networks Junos OS and Junos OS Evolved. Affected releases include Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases, along with the corresponding Junos OS Evolved respins 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all later releases.

The CVSS score of 6.7 classifies the flaw as moderate severity. The vulnerability is exploitable by an attacker with unauthenticated access to the chassis‑internal network, a segment typically considered trusted. The attack requires visibility into chassis‑internal interfaces, reducing the likelihood of remote exploitation from the public internet. No public exploit is currently known and the EPSS score indicates a low likelihood of exploitation (< 1%). Nonetheless, the availability of the flaw and its potential to cause denial of service make it a non‑negligible risk, especially where chassis‑internal traffic is not tightly segmented.