The vulnerability is an out‑of‑bounds write in Juniper Networks' routing protocol daemon (rpd). When IS‑IS link protection and backup‑selection are configured, an adjacent unauthenticated attacker can send crafted data that causes the rpd to write beyond allocated memory, leading to a crash. The crash results in a denial of service for the affected routing device, disrupting traffic forwarding and potentially isolating network segments. The weakness is identified as CWE‑787.

Juniper Networks hardware running Junos OS or Junos OS Evolved is impacted. Affected releases include Junos OS 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and all later releases. For Junos OS Evolved, affected releases are 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO, and all later releases.

The CVSS score is 7.2, indicating a high impact. The EPSS score is 0.27%, reflecting a very low but nonzero likelihood of exploitation. The vulnerability allows an attacker without authentication to trigger the crash. The issue is not listed in the CISA KEV catalog. The likely attack vector is through adjacent IS‑IS neighbors; an attacker can send a malicious IS‑IS packet that exploits the out‑of‑bounds write when backup‑selection is enabled. This can be done remotely from a connected device but requires proximity in the same autonomous system or adjacency.