Juniper Junos OS: Stack-based buffer overflow in routing daemon (rpd)

Summary

A stack-based buffer overflow in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved allows an attacker to execute arbitrary commands with root privileges. The attack requires a configured external BGP neighbor and enabled BGP Monitoring Protocol (BMP) route monitoring. The CVSS vector requires no authentication, but the attacker must already have a BGP peer session.

Affected

• Junos OS: versions before 23.2R2-S7.7, 23.4 before 23.4R2-S8.13, 24.2 before 24.2R2-S5.5, 24.4 before 24.4R2-S5, 25.2 before 25.2R2-S2, 25.4 before 25.4R1-S3, 26.2 before 26.2R1-S2
• Junos OS Evolved: versions before 23.2R2-S7.7-EVO, 23.4 before 23.4R2-S8.11-EVO, 24.2 before 24.2R2-S5.6-EVO, 24.4 before 24.4R2-S5-EVO, 25.2 before 25.2R2-S2-EVO, 25.4 before 25.4R1-S3-EVO, 26.2 before 26.2R1-S2-EVO, plus 23.4X100, 25.2X100 before 25.2X100-D35-EVO and 25.4X300 before 25.4X300-D40-EVO
• Only configurations with BMP route monitoring enabled are affected (per the CVE record, default configuration unaffected).

Fixed in

• Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
• Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases
• Releases 23.2, 23.4 and 24.2 have respins; previously published builds were rebuilt.

Workaround

• The vendor reports no known workarounds.
• Unverified third-party suggestion: disable BMP if no monitoring station is needed. Verify this on JSA112187 before relying on it.

Exploitation

• Juniper SIRT is not aware of any malicious exploitation.
• No public exploit or technical write-up found. EPSS score 0.00558 (low).
• CISA SSVC: exploitation none, automatable yes, technical impact total.

Our recommendation

• Identify all Junos OS and Junos OS Evolved devices and check whether BMP and external BGP peers are configured.
• If BMP is not required, disable it after verifying the change on JSA112187.
• Limit BGP peers to those that are genuinely required.
• Upgrade to the fixed releases listed in JSA112187. Plan replacement of hardware that is out of support.
• Monitor JSA112187 and NVD for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper Security Advisory JSA112187 supportportal.juniper.net
• DEV Community: BMP as attack surface on Junos dev.to
• DEV Community: Patch ordering for Junos flaws dev.to
• SecurityOnline: Juniper patches critical Junos OS vulnerabilities securityonline.info
• CIRCL/Vulners CVE-2026-33796 vulners.com
• Threatint mirror of CVE record cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:51.