Junos OS and Junos OS Evolved: Stack-based buffer overflow in rpd via BGP/EVPN

Summary

A stack-based buffer overflow in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved can be triggered by a configured BGP/EVPN peer sending protocol-valid route advertisements for an EVPN-VPWS service. On Junos OS, an attacker can execute code as root, which gives full control of the device. On Junos OS Evolved, the attack causes an rpd crash. The attack requires a configured BGP/EVPN peer with EVPN-VPWS in use.

Affected

• Junos OS: 0 to before 23.2R2-S7.7; 23.4 to before 23.4R2-S8.13; 24.2 to before 24.2R2-S5.5; 24.4 to before 24.4R2-S5; 25.2 to before 25.2R2-S2; 25.4 to before 25.4R1-S3; 26.2 to before 26.2R1-S2
• Junos OS Evolved: 0 to before 23.2R2-S7.7-EVO; 23.4 to before 23.4R2-S8.11-EVO; 24.2 to before 24.2R2-S5.6-EVO; 24.4 to before 24.4R2-S5-EVO; 25.2 to before 25.2R2-S2-EVO; 25.4 to before 25.4R1-S3-EVO; 26.2 to before 26.2R1-S2-EVO; 23.4X100; 25.2X100 to before 25.2X100-D35-EVO; 25.4X300 to before 25.4X300-D40-EVO
• Required configuration: BGP/EVPN signaling, EVPN-VPWS routing instances

Fixed in

• Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all later releases
• Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all later releases
• Junos OS Evolved 23.4X100: fixed version unknown, verify in JSA112187
• Releases 23.2, 23.4 and 24.2 have been respun; previously published builds must be replaced

Workaround

No known workarounds according to Juniper.

Exploitation

• Juniper SIRT is not aware of any malicious exploitation.
• The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog (as of the research date).
• VulDB reports no public exploit.
• CISA SSVC: exploitation none, automatable yes, technical impact total.

Our recommendation

• Identify all Junos OS and Junos OS Evolved devices, including carrier-managed or managed-service equipment.
• Check whether EVPN-VPWS is configured and which BGP/EVPN peers can reach the device.
• Restrict BGP peering to known, trusted peers and block BGP sessions from untrusted networks.
• Patch to the fixed releases in JSA112187 with priority, and verify the fixed version for 23.4X100 with Juniper.
• Ask your managed-service provider or carrier for their patch status.
• Monitor for unexpected rpd crashes and unusual BGP/EVPN route advertisements.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper Security Advisory JSA112187 supportportal.juniper.net
• Canadian Centre for Cyber Security advisory AV26-1043 www.cyber.gc.ca
• VulDB entry 420181 vuldb.com
• OpenCVE CVE-2026-101982 app.opencve.io
• Vulners CIRCL CVE-2026-101982 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:47.