An off‑by‑one out‑of‑bounds write occurs in the bgp_flowspec_op_decode() function of FRRouting’s FlowSpec processing. The defect corrupts memory as a crafted FlowSpec component is parsed, which can crash the BGP daemon and render the routing service unavailable. The primary effect is a denial of service; no information disclosure or privilege escalation is described.

FRRouting FRR version stable/10.0 is affected. No other vendors or products appear to be impacted based on the current information.

The CVSS score is 7.5, indicating a significant severity. EPSS is not available, so the exact exploitation likelihood cannot be quantified. The vulnerability is listed as not in the CISA KEV catalog. The likely attack vector is through network traffic that includes a malicious FlowSpec component sent to the FRRouting instance. An attacker with network reach to the BGP service can trigger a crash, causing service interruption.