A stack‑based buffer overflow in the routing protocol daemon (rpd) enables an attacker to run arbitrary commands with root privileges on Juniper Networks devices. The bug is triggered when a configured external BGP neighbor receives BGP messages over BMP route monitoring. The overflow occurs within the rpd, causing a memory corruption that can be exploited to execute shell commands or arbitrary code. The vulnerability falls under CWE-121.

Juniper Networks Junos OS and Junos OS Evolved devices running any release before the fixed versions listed in the advisory are affected. The advisory lists patched releases—Junos OS 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all subsequent releases—so any earlier release remains vulnerable.

The CVSS score of 9.3 classifies this vulnerability as Critical, indicating that remote exploitation leads to full system compromise. The EPSS score is less than 1%, exploitation, but the absence of a KEV listing does not diminish the severity; the weakness is exploitable over the network via BGP/BMP. Attackers would need to be able to establish a BGP session with the target device and enable BMP route monitoring. Once the buffer overflow is triggered, the attacker gains root access, with the potential to modify device configuration, exfiltrate data, or run arbitrary code.