Juniper Junos OS: Stack-based buffer overflow in srxpfe on SRX Series
Summary
A stack-based buffer overflow in the srxpfe process of Junos OS on SRX Series devices allows an unauthenticated network attacker to send a crafted packet over a configured GRE tunnel. Successful exploitation can lead to code execution as root or to a denial of service. Devices without a GRE tunnel configuration are not exposed through this path. The CVSS v4 base score is 9.3 (critical).
Affected
- Junos OS 0 to before 23.2R2-S7.7
- Junos OS 23.4 to before 23.4R2-S8.13
- Junos OS 24.2 to before 24.2R2-S5.5
- Junos OS 24.4 to before 24.4R2-S5
- Junos OS 25.2 to before 25.2R2-S2
- Junos OS 25.4 to before 25.4R1-S3
- Junos OS 26.2 to before 26.2R1-S2
Default configuration: unaffected. Exposure requires a configured GRE tunnel. Sources disagree on version ranges; verify against JSA112186.
Fixed in
- 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases (per CNA record)
- For releases 23.2, 23.4 and 24.2, specific respins apply; previously published builds were rebuilt.
- Confirm the exact build against Juniper advisory JSA112186 before upgrading.
Workaround
Unknown. Juniper states there are no known workarounds.
- Analyst suggestion, not vendor guidance: restrict GRE peers at upstream filters and remove unused GRE tunnels.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- No public proof-of-concept was reported at the time of research.
- CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
Our recommendation
- Check SRX configurations for GRE tunnels (for example with show configuration | match gre). If none exist, record this and monitor.
- Restrict GRE peers to known addresses and remove unused tunnels.
- Compare running builds with JSA112186 and schedule the upgrade.
- Treat GRE-terminating SRX devices as high-value assets and monitor them closely.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112186 supportportal.juniper.net
- Tenable CVE-2026-33792 www.tenable.com
- OpenCVE CVE-2026-33792 app.opencve.io
- SecurityOnline: Juniper patches critical Junos OS vulnerabilities securityonline.info
- ThreatInt CVE-2026-33792 cve.threatint.com
- GitHub Advisory GHSA-8g7f-8jqh-v9wr github.com
- TheHackerWire CVE-2026-33792 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:52.
Original description (NVD)
A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or cause a denial of service via a crafted packet received on a configured GRE tunnel.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.