The vulnerability is a reachable assertion in the routing protocol daemon that allows an attacker to trigger an rpd crash by sending malformed BGP MCAST-VPN updates from a configured eBGP peer. The crash results in a denial of service affecting routing functions and potentially disrupting network connectivity. This issue is classified as a CWE-617 assertion failure.

Juniper Networks Junos OS and Junos OS Evolved are affected. Vulnerable releases include: Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases; and Junos OS Evolved 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases.

The CVSS score is 8.7, indicating a high severity. EPSS score is < 1%, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not a known exploited vulnerability at this time. An attacker would likely need to be able to send BGP MCAST-VPN update messages to the router, which typically requires network access to the router from an external eBGP peer. The crash can be triggered by malformed packets, implying that a remote attacker with the ability to advertise routes could cause a denial of service.