A malformed PIM Bidir message can trigger a NULL pointer dereference inside the rpd process of Juniper Networks Junos OS and Junos OS Evolved, enabling an unauthenticated adjacent attacker to interrupt routing services. The failure results in a denial‑of‑service condition that compromises network availability. The weakness is categorized as a NULL pointer dereference (CWE‑476).

The vulnerability affects Juniper Networks Junos OS and Junos OS Evolved. All releases prior to the CNA‑designated patched builds listed in the solution are vulnerable. Specifically, any Junos OS release before 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 are vulnerable, while those patched releases and later are fixed. For Junos OS Evolved, vulnerable releases are those before 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO; all later Evolved releases are fixed.

The CVSS score of 7.1 indicates a high severity. The EPSS score of <1% suggests a very low probability of exploitation, and the lack of a KEV listing indicates that no publicly known exploitation has been observed yet. The attacker must be adjacent, possess no authentication, and be able to send crafted PIM Bidir messages to trigger the NULL dereference, which will crash the routing daemon and cause service disruption.