An out‑of‑bounds write in the Juniper routing protocol daemon (rpd) can be triggered by an attacker who has access to a configured BGP EVPN peer and subscriptions to the l2vpn‑evpn Route Information Base telemetry sensor. When that telemetry request is processed, the flaw causes rpd to crash, interrupting routing protocols until the daemon restarts and the network re‑converges. This results in a denial of service that affects all routing functions on the affected device.

Software vendors Juniper Networks’ Junos OS and Junos OS Evolved are impacted. The vulnerability applies to the releases listed by Juniper: Junos OS versions 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all subsequent releases; and Junos OS Evolved versions 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all subsequent releases.

The CVSS score of 8.7 indicates a high severity. EPSS score of 0.00373 indicates a very low exploitation probability while the lack of a publicly listed KEV entry and the remote nature of the required BGP EVPN peer access suggest that exploitation is possible over the network from a connected peer. The vulnerability can be mitigated by applying the patched releases listed by Juniper; no workaround is available. The attack vector is likely through normal BGP peer communication; therefore any device that exposes BGP EVPN to outsiders is potentially vulnerable.