Juniper Junos OS: Stack-based buffer overflow in routing daemon rpd
Summary
Junos OS and Junos OS Evolved contain a stack-based buffer overflow in the routing protocol daemon rpd. An unauthenticated attacker who is an adjacent LDP peer can send a malformed LDP Label Mapping message to crash rpd or potentially execute arbitrary code. The flaw only applies where LDP is enabled on an interface; the CVSS 4.0 base score is 8.7 (High).
Affected
- Junos OS: 23.4 to before 23.4R2-S8.13; 24.2 to before 24.2R2-S5.5; 24.4 to before 24.4R2-S5; 25.2 to before 25.2R2-S2; 25.4 to before 25.4R1-S3; 26.2 to before 26.2R1-S2
- Junos OS Evolved: 23.4 to before 23.4R2-S8.11-EVO; 24.2 to before 24.2R2-S5.6-EVO; 24.4 to before 24.4R2-S5-EVO; 25.2 to before 25.2R2-S2-EVO; 25.4 to before 25.4R1-S3-EVO; 26.2 to before 26.2R1-S2-EVO; 23.4X100; 25.2X100 to before 25.2X100-D35-EVO; 25.4X300 to before 25.4X300-D40-EVO
- Default configuration is unaffected; LDP must be enabled (protocols ldp interface).
Fixed in
- Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
- Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases
- Confirm the exact release for the 23.4X100 and X-series entries in the vendor advisory.
Workaround
There are no known workarounds for this issue according to the CNA record. Restricting LDP on untrusted interfaces is a general measure, not confirmed by the vendor for this CVE.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- Discovered internally by Juniper according to the CVE record.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No public proof of concept found in the research notes.
Our recommendation
- Check whether Junos OS or Junos OS Evolved devices run LDP.
- If yes, plan patching to the fixed releases in JSA112187 with priority.
- Until patched, restrict LDP sessions to known peers and limit LDP-facing interfaces to trusted links.
- Monitor for NVD analysis updates and any KEV addition.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112187 supportportal.juniper.net
- OpenCVE: CVE-2026-101981 app.opencve.io
- ThreatInt: CVE-2026-101981 cve.threatint.com
- Strix: CVE-2026-101981 www.strix.ai
- OffSeq Radar: CVE-2026-101981 radar.offseq.com
- Positive Technologies PT-2026-113833 via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:53.
Original description (NVD)
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.