A buffer size miscalculation in the routing protocol daemon (rpd) allows a configured eBGP neighbor to trigger a crash when multipath next-hops are processed. The result is an out-of‑band denial of service that takes the router offline, affecting network availability and potentially disrupting critical routing functions.

The vulnerability affects Juniper Networks Junos OS and Junos OS Evolved. Implicated releases include Junos OS 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all subsequent releases; Junos OS Evolved 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all following releases.

The CVSS score of 8.7 indicates high severity. Because the EPSS score is not available, the exact probability of exploitation cannot be quantified, but the risk remains significant due to the ease of manipulating the BGP UPDATE path from a remote neighbor. The vulnerability is not listed in the CISA KEV catalog, so no known active exploitation campaigns have been reported. The attack vector is inferred to be a remote network attacker capable of sending malicious BGP UPDATE messages to the target router.