A stack‑based buffer overflow exists in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved. The vulnerability is triggered when a configured flowspec BGP peer sends a specially malformed flowspec NLRI while BGP update‑threading is enabled. The overflow can overwrite critical memory structures, leading to arbitrary code execution on the routing engine or a denial of service that disables the routing daemon. The impact is a full compromise of the router’s operating system, allowing an attacker to gain persistent remote access, modify routing state, or disrupt network services.

Affected vendors include Juniper Networks. Affected products are Junos OS and Junos OS Evolved. Product versions impacted are all releases prior to the fixed versions listed in the vendor advisory, which include Junos OS through 26.4R1 and JuniOS OS Evolved through 26.4R1‑EVO. Version details are enumerated in the CNA solution and are required for remediation.

The vulnerability has a high CVSS score of 9.3, indicating a severe risk. The EPSS score is less than 1%, suggesting a very low but nonzero exploitation probability, and the lack of a KEV listing does not diminish the severity. The attack requires an attacker to control a BGP flowspec peer that connects to the vulnerable router and to enable update‑threading. Once those conditions are met, remote code execution can be achieved with minimal effort, making the risk high for exposed or poorly isolated routers.