Juniper Junos OS: Heap-based buffer overflow in sdxd service-deployment daemon

Summary

A heap-based buffer overflow in the sdxd service-deployment daemon of Junos OS and Junos OS Evolved allows a remote, unauthenticated attacker to execute code as root or cause a denial of service. The attacker must be able to control or intercept the configured SDX/SRC server connection and send a crafted frame over the service-deployment TCP connection. Exposure depends on whether service deployment is configured. The CVSS 4.0 score is 9.3 (Critical).

Affected

• Junos OS: 0 to < 23.2R2-S7.7; 23.4 to < 23.4R2-S8.13; 24.2 to < 24.2R2-S5.5; 24.4 to < 24.4R2-S5; 25.2 to < 25.2R2-S2; 25.4 to < 25.4R1-S3; 26.2 to < 26.2R1-S2 (default: unaffected)
• Junos OS Evolved: 0 to < 23.2R2-S7.7-EVO; 23.4 to < 23.4R2-S8.11-EVO; 24.2 to < 24.2R2-S5.6-EVO; 24.4 to < 24.4R2-S5-EVO; 25.2 to < 25.2R2-S2-EVO; 25.4 to < 25.4R1-S3-EVO; 26.2 to < 26.2R1-S2-EVO; 23.4X100; 25.2X100 to < 25.2X100-D35-EVO; 25.4X300 to < 25.4X300-D40-EVO (default: unaffected)

Fixed in

• Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
• Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases
• Fixed release for the 23.4X100 train: Unknown.

Workaround

• No known workarounds according to the CVE record.
• Check whether the service-deployment configuration (system services service-deployment servers) is in use. If it is not, the exposure is much lower.

Exploitation

• Juniper SIRT is not aware of any malicious exploitation.
• Not listed in CISA KEV (as reported by secondary sources).
• No public proof of concept found at the time of writing.
• CISA SSVC: exploitation none, automatable yes, technical impact total.

Our recommendation

• Inventory all Junos OS and Junos OS Evolved devices now.
• Check whether SDX/SRC service deployment is configured and where the server address points.
• Treat devices with this workflow enabled as high priority and restrict access to the SDX/SRC connection path.
• Apply the fixed releases from the Juniper advisory JSA112187 soon, starting with devices where the workflow is enabled.
• Verify the version data and the 23.4X100 fix against JSA112187 before acting.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper Security Advisory JSA112187 supportportal.juniper.net
• OpenCVE: CVE-2026-102175 app.opencve.io
• Strix: CVE-2026-102175 www.strix.ai
• ThreatInt: CVE-2026-102175 cve.threatint.com
• Positive Technologies record PT-2026-113925 vulners.com
• Analysis: pre-authentication heap overflow in Junos sdxd dev.to
• Analysis: Junos October 2026 flaws without a KEV entry dev.to
• Analysis: auditing Junos devices for exposure dev.to

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:54.