The vulnerability is an integer underflow that occurs when FRRouting processes BGP UPDATE messages. A specially crafted UPDATE can trigger the underflow, causing the routing process to terminate and the router to stop forwarding traffic. This results in a loss of routing availability, effectively dropping network connectivity for any peers that depend on the affected router.

FRRouting versions in the stable/10.0 through stable/10.6 branches are affected. Any deployment of these versions that accepts BGP UPDATE messages is in scope, regardless of the host operating system.

The flaw can be exploited remotely by a neighboring router that can send a malformed UPDATE message. Based on the description, it is inferred that the attacker needs an existing BGP session to transmit the crafted UPDATE without additional authentication. The issue is not listed in the CISA KEV catalog, and the EPSS score is < 1%. Because it causes a complete denial of the routing service, the risk to availability is high. The CVSS score of 7.5 indicates a high severity level, underscoring the critical nature of routing services.