A memory‑corrupting bug in the cfmd process of Junos OS and Junos OS Evolved allows an attacker to trigger a crash of the daemon. The crash causes a denial of service for the affected interface. In addition, the out‑of‑bounds read leaks a small portion of memory from the cfmd process, giving the attacker limited information disclosure.

The flaw is present in Juniper Networks Junos OS and Junos OS Evolved. Software releases that contain the fix include Junos OS 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all later releases, as well as Junos OS Evolved 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all subsequent releases.

The CVSS score of 7.1 indicates a medium to high level of risk. The EPSS score of <1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploitation at this moment. An unauthenticated attacker who can place themselves on the adjacent network and send a crafted Ethernet CFM message to a configured interface can exploit the flaw. The attack requires proximity to the network and the ability to send Ethernet frames, but it does not require authentication or access to the device’s management interface.