The vulnerability is a heap-based buffer overflow in Juniper Networks’ secure-dot1xd process on Junos OS and Junos OS Evolved. An unauthenticated attacker on an adjacent network can send a crafted EAPOL frame to an 802.1X‑authenticated interface, which can overwrite adjacent heap memory and allow the attacker to execute arbitrary code with root privileges or to cause a denial of service. The flaw is a classic buffer overflow (CWE‑122) that jeopardizes the integrity and availability of the affected devices.

Affected devices are Juniper Networks equipment running Junos OS or Junos OS Evolved. The specific releases impacted include Junos OS 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all subsequent releases, and Junos OS Evolved 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all subsequent releases. Earlier releases of the 23.2, 23.4, and 24.2 lines and their EVO variants have been rebuilt to contain the fix.

The CVSS score of 8.7 indicates a high severity with remote code execution capability. The EPSS score of < 1% indicates a very low exploitation probability, and the absence of a known public exploit and of inclusion in the CISA KEV catalog further suggest that current exploitation activity is unlikely. However, because the attack requires only network adjacency and no privilege on the target, a determined adversary can instrument EAPOL traffic to trigger the overflow. If successful, the attacker would obtain root access for the entire device, enabling system compromise, or could cause a denial of service by crashing secure-dot1xd. Prompt patching is strongly recommended.