A stack‑based buffer overflow exists in the jdhcpd process of Juniper Networks Junos OS. An unauthenticated attacker adjacent to the device can craft a malicious DHCP client response that overflows a buffer and crashes jdhcpd. The resulting denial of service interrupts DHCP, relay, and zero‑touch provisioning services, leading to loss of network configuration for clients on the affected device. The flaw is identified as CWE‑121 and has no impact beyond service interruption.

Juniper Networks Junos OS is affected. The vulnerability applies to releases 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and all subsequent releases. Earlier versions of the 23.2, 23.4, and 24.2 branches that have not been respun are also vulnerable.

The vulnerability carries a CVSS score of 8.7, rated high severity. The EPSS score is <1%, indicating a very low but non‑zero exploitation probability, and the flaw is not listed in CISA’s KEV catalog. The attack requires proximity to the device on the same broadcast domain to submit a crafted DHCP client message. No authentication or privileged access is needed, making exploitation straightforward for an adjacent host that can send malicious packets to the firewall’s DHCP client interface.