An out‑of‑bounds write vulnerability exists in Juniper's routing protocol daemon (rpd). When an adjacent router sends a specific sequence of BGP community strings that include a graceful‑shutdown sender community during advertisement, the vulnerable code fails to bounds‑check the input, causing rpd to crash. The crash results in a denial‑of‑service condition that disrupts routing and can affect network reachability.

Both Juniper Networks Junos OS and Junos OS Evolved are affected. The vulnerability applies to all current releases of these operating systems until they are updated to the patched versions listed in the official advisory, including 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all subsequent releases, with the equivalent Evo releases.

The CVSS score of 6.9 indicates moderate severity. Exploitation requires an attacker to be an adjacent router within the same BGP session and to craft the specific BGP communities, so the attack is constrained to network neighbors and does not require remote code execution. The EPSS score is less than 1%, indicating a very low exploitation probability. The vulnerability is not currently tracked in the CISA KEV catalog, suggesting that widespread exploitation has not yet been reported. Nevertheless, any crash of the routing daemon can lead to a temporary loss of routing services, making prompt patching a priority.