The vulnerability is a heap-based buffer overflow in Juniper Networks’ secure-dot1xd process on Junos OS and Junos OS Evolved. An unauthenticated attacker on an adjacent network can send a crafted EAPOL frame to an 802.1X‑authenticated interface, which can overwrite adjacent heap memory and allow the attacker to execute arbitrary code with root privileges or to cause a denial of service. The flaw is a classic buffer overflow (CWE‑122) that jeopardizes the integrity and availability of the affected devices.

Affected devices are Juniper Networks equipment running Junos OS or Junos OS Evolved. The specific releases impacted include Junos OS 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all subsequent releases, and Junos OS Evolved 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all subsequent releases. Earlier releases of the 23.2, 23.4, and 24.2 lines and their EVO variants have been rebuilt to contain the fix.

The CVSS score of 8.7 indicates a high severity with remote code execution capability. EPSS data are not available, but the lack of a known exploit in the public domain and the absence from the CISA KEV catalog suggest a moderate exploitation probability in the short term. However, because the attack requires only network adjacency and no privilege on the target, a determined adversary can readily instrument EAPOL traffic to trigger the overflow. If successful, the attacker would obtain root access for the entire device, enabling system compromise, or could cause a denial of service by crashing secure-dot1xd. Prompt patching is strongly recommended.