IT SBIT Services
Schneeberger
DEEN
CVE tracker

Juniper Junos OS: Stack-based buffer overflow in jdhcpd DHCPv4 client

CVE-2026-102052High 8.7

← All vulnerabilities

Summary

A stack-based buffer overflow in the jdhcpd DHCP daemon of Junos OS and Junos OS Evolved is triggered by a malformed DHCPv4 server response. The flaw only applies when the DHCPv4 local-client feature is used. An adjacent, unauthenticated attacker on the same network segment can cause a denial of service or, according to the CVE description, execute arbitrary code with root privileges. The CVSS 4.0 base score is 8.7 (High).

Affected

  • Junos OS: releases before 23.2R2-S7.7, 23.4 before 23.4R2-S8.13, 24.2 before 24.2R2-S5.5, 24.4 before 24.4R2-S5, 25.2 before 25.2R2-S2, 25.4 before 25.4R1-S3, 26.2 before 26.2R1-S2 (default configuration unaffected)
  • Junos OS Evolved: releases before 23.2R2-S7.7-EVO, 23.4 before 23.4R2-S8.11-EVO, 24.2 before 24.2R2-S5.6-EVO, 24.4 before 24.4R2-S5-EVO, 25.2 before 25.2R2-S2-EVO, 25.4 before 25.4R1-S3-EVO, 26.2 before 26.2R1-S2-EVO, plus 23.4X100, 25.2X100 before 25.2X100-D35-EVO, 25.4X300 before 25.4X300-D40-EVO (default configuration unaffected)

Fixed in

  • Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
  • Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases
  • Junos OS Evolved 23.4X100: Unknown (check JSA112187)

Workaround

Unknown. The CNA record states there are no known workarounds. Disabling the DHCPv4 local-client feature where it is not needed reduces exposure.

Exploitation

  • Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
  • CISA SSVC assessment: exploitation none, not automatable, total technical impact.

Our recommendation

  • Identify all Junos OS and Junos OS Evolved devices and check whether the DHCPv4 local-client feature is configured.
  • Where the feature is in use, update to the fixed releases listed above. For branch 23.4X100, confirm the fixed release in advisory JSA112187.
  • Where the feature is not needed, disable it as an interim measure.
  • Limit which hosts can reach the affected Layer 2 segments, such as guest or shared VLANs.
  • Monitor for daemon crashes or restarts of jdhcpd and review the vendor advisory regularly.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:12.

Original description (NVD)

A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause denial of service or execute arbitrary code with root privileges via a malformed DHCPv4 server response when the DHCPv4 local-client feature is used.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed