A use‑after‑free flaw exists in the dot1xd daemon that handles 802.1X authorization changes. When an authenticated, network‑adjacent attacker triggers a port flop while the daemon processes a change of authorization request, a freed pointer may be referenced again, causing dot1xd to crash. If the attacker controls the process context, the flaw could also allow arbitrary code execution as root.

The vulnerability affects Juniper Networks Junos OS and Junos OS Evolved systems that have 802.1X port‑based network access control enabled. In Junos OS, all releases from 23.2R2-S1 up through 25.2R1-S2 (and earlier revisions) are vulnerable. In Junos OS Evolved, the vulnerable range extends from 23.2R2-S1 through 25.2R2-EVO.

The CVSS score of 7.5 indicates a high severity, but EPSS is less than 1 percent, suggesting exploitation is unlikely at the current time. The flaw was not listed in CISA’s KEV catalog, but the attack requires authenticated, adjacent access and precise timing of port flapping. Successful exploitation would crash the daemon, leading to a denial of service, or, if conditions allow, execute code in the root context, which would be catastrophic for the device.