A NULL Pointer Dereference (routing process daemon) of Juniper Junos OS allows an unauthenticated adjacent attacker to send an IGMPv3 membership report on a directly connected network, causing the RPD to crash. The resulting DoS can disrupt routing services, potentially causing traffic loss and temporary loss of connectivity for affected routers. The weakness is a classic NULL pointer dereference (CWE-476).

Affected systems include Juniper Networks Junos OS and Junos OS Evolved running on MX Series and ACX Series routers. The vulnerability impacts the following releases: Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases; as well as Junos OS Evolved 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases. Specific respins for the 23.2, 23.4, and 24.2 releases (and their EVO counterparts) provide the fix.

The CVSS score of 7.1 is a factual metric provided by the CVE. Based on this score, it is inferred that the vulnerability has a high impact and may be likely to be exploited if an attacker can deliver traffic on a directly connected network. The EPSS score is 0.0025 (0.25%) and indicates a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The fact that widespread exploitation is not yet reported is factual, and the weakness is local and does not require authentication. Administrators should consider the potential impact on critical routing paths and apply the fix promptly.