Junos OS Evolved contains a stack‑based buffer overflow in the kernel that can be triggered by a crafted TCP packet when key‑chain authentication is enabled for BGP or LDP. The flaw, classified as CWE‑121, allows an unauthenticated remote attacker to cause a kernel panic, effectively denying service on the affected device.

The vulnerability affects Juniper Networks Junos OS Evolved firmware in versions prior to 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO, and all subsequent releases. Earlier releases 23.2‑EVO, 23.4‑EVO, and 24.2‑EVO have respins that contain the fix.

Risk is quantified by a CVSS score of 9.2, indicating high severity, and an EPSS score of <1%. The vulnerability is not listed in CISA’s KEV catalog. The exploitation path requires a remote attacker to send a malformed TCP packet while key‑chain authentication is enabled for BGP or LDP; successful exploitation results in a kernel panic and loss of availability, potentially disrupting routing services on the device.