A malformed PIM Bidir message can trigger a NULL pointer dereference inside the rpd process of Juniper Networks Junos OS and Junos OS Evolved, enabling an unauthenticated adjacent attacker to interrupt routing services. The failure results in a denial‑of‑service condition that compromises network availability. The weakness is categorized as a NULL pointer dereference (CWE‑476).

The vulnerability affects Juniper Networks Junos OS and Junos OS Evolved. All releases before 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and subsequent Junos OS releases are impacted. For Junos OS Evolved, every release before 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and later are considered vulnerable.

The CVSS score of 7.1 indicates a high severity. Because EPSS is not available, the exact likelihood of exploitation remains uncertain, but the absence of a KEV listing suggests no publicly known exploited instances yet. The attacker must be adjacent, possessing no authentication, and capable of sending crafted PIM Bidir messages to trigger the NULL dereference, which will crash the routing daemon and cause service disruption.