A stack‑based buffer overflow in the srxpfe component of Junos OS and Junos OS Evolved allows a local L2 attacker to execute arbitrary code with root privileges through high‑availability fabric traffic. This flaw is a classic CWE‑121 type error, where malformed packet handling leads to uncontrolled memory access, giving an attacker full control over the system.

The vulnerability affects Juniper Networks Junos OS and Junos OS Evolved on SRX Series devices when chassis‑cluster is enabled. Supported releases that contain the fix include 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and equivalent Junos OS Evolved builds. Devices running older or unsupported releases remain vulnerable.

The EPSS score of 0.00351 (i.e., < 1%) indicates low exploitation probability. The CVSS score of 8.7 indicates a high severity of this flaw. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits at this time. Because the description cites L2‑adjacent traffic and high‑availability fabric packets as the trigger, the likely attack vector involves an attacker on the same local network segment sending crafted fabric traffic to exploit the overflow.