FRRouting before version 10.5.3 contains an integer overflow in several OSPF Traffic Engineering and Segment Routing TLV parser functions. The overflow occurs when a 32‑bit size value returned by the TLV_SIZE() macro is stored in a 16‑bit accumulator, causing the loop termination condition to fail while pointer advancement continues unchecked. This out‑of‑bounds memory read can crash all routers that are part of the same OSPF area or autonomous system, resulting in a denial of service that affects routing for that entire network segment.

The vulnerability affects all installations of the FRRouting software named frr that are running a version older than 10.5.3. No specific patch level is listed for earlier minor releases, so any deployment older than 10.5.3 is potentially exposed.

The CVSS score of 6.0 characterizes this vulnerability as a moderate risk. The EPSS value is not available, suggesting that no recent exploitation metrics are reported, but the lack of a KEV listing does not preclude exploitation. Exploitation requires an attacker to have an established OSPF adjacency with the target router, after which a crafted LS Update packet containing a malicious Type 10 or 11 opaque LSA can trigger the overflow. The attack is local to the OSPF peer relationship and does not rely on external remote access, so it is not a typical internet‑wide vulnerability, but it can still cause disruptive denial of service within an OSPF domain.