A stack-based buffer overflow flaw was discovered in the srxpfe process of Junos OS on SRX Series devices. An unauthenticated network attacker can craft a packet to a configured GRE tunnel that overflows an internal buffer, allowing execution of arbitrary code with root privileges or causing a denial of service. The vulnerability is classified as CWE-121, indicating a classic stack buffer overflow.

Juniper Networks Junos OS on SRX Series routers. The flaw affects firmware releases 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases; specific respins were issued for 23.2, 23.4, and 24.2 releases.

Based on the description, the likely attack vector is an unauthenticated remote attacker sending a crafted GRE packet to a device with a GRE tunnel configured. The CVSS score of 9.3 reflects severe impact. The EPSS score of <1% indicates a very low but non‑zero exploitation probability, yet the attack surface is broad: any device with a GRE tunnel enabled can be targeted from the network. The vulnerability is not currently listed in CISA KEV, but the lack of a workaround and the high severity suggest that exploitation is feasible. An attacker could exploit the flaw by transmitting a crafted GRE packet, allowing code execution as root or causing a denial of service.