Arista EOS: Out-of-bounds read in RPKI agent via malformed Error Report
Summary
Arista EOS, a network operating system used mainly in data centre and enterprise switching and routing, contains an out-of-bounds read (CWE-125). A malformed Error Report can make EOS read beyond packet boundaries. An attacker who can send such a message can terminate the RPKI agent or expose memory contents through logging. The CVSS vector indicates network access without credentials, but the attack requirements (AT:P) and the affected configuration (RPKI cache under BGP) limit exposure.
Affected
- Arista EOS 4.37.0F
- Arista EOS 4.36.0F to 4.36.2F
- Arista EOS 4.35.0F to 4.35.6M
- Arista EOS 4.34.0F to 4.34.8M
- Arista EOS 4.33.0F to 4.33.10M
- Arista EOS 4.24.0F to before 4.33.0F (exact start of range unconfirmed)
- Required configuration: BGP with an RPKI cache (rpki cache under router bgp)
- Default status: unaffected
Fixed in
Unknown. Check Arista Security Advisory 0222 for fixed releases.
Workaround
- Unknown from vendor sources. Check the Arista advisory for hotfix options.
- If RPKI route origin validation is not required, disabling the RPKI cache configuration reduces exposure.
Exploitation
Unknown. No reports of in-the-wild exploitation or public proof-of-concept were found at the time of research. This has not been verified against CISA KEV or GitHub advisories.
Our recommendation
- Check whether Arista EOS devices run BGP with RPKI validation (show bgp rpki cache).
- Compare the EOS version with the affected list and the fixed releases in Arista Security Advisory 0222.
- Plan an EOS upgrade or hotfix in a maintenance window.
- If RPKI validation is not needed, consider disabling it until the device is patched.
- Monitor RPKI agent restarts and unusual log entries.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Arista Security Advisory 0222 www.arista.com
- CVE Record CVE-2026-121292 www.cve.org
- Strix CVE-2026-121292 www.strix.ai
- ThreatInt CVE-2026-121292 cve.threatint.com
- Arista Networks (Wikipedia) en.wikipedia.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:22.
Original description (NVD)
A malformed Error Report can cause EOS to read beyond packet boundaries, potentially terminating the RPKI agent or exposing unintended memory contents through logging.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.