A reachable assertion in the l2ald daemon allows an attacker with access to a configured ICCP peer to send a malformed MC‑LAG message that causes l2ald to restart, resulting in a denial of service on the affected device. The assertion failure is triggered when the device processes the message, and the crash causes normal Layer‑2 forwarding functions to fail until the process is restarted.

The flaw affects Juniper Networks Junos OS and Junos OS Evolved devices. Vulnerable releases include Junos OS versions 23.2R2‑S7.7 through 26.4R1 and all subsequent releases, and Junos OS Evolved versions 23.2R2‑S7.7‑EVO through 26.4R1‑EVO, including all respins and later releases listed by Juniper.

The CVSS score of 7.1 indicates a high severity impact. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog. The attack likely requires an adversary to have network access to an ICCP peer that the device is connected to; the attacker must be able to send a crafted MC‑LAG message to exploit the problem. Because the flaw is a local denial‑of‑service condition triggered by a specific protocol message, exploitation requires the attacker to have sufficient connectivity to the Junos device over the ICCP channel; it is not a purely remote web‑based exploit.