Description

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T18:17:13.120Z",
  "pubdate": "2026-10-14T18:17:13.120Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability exists within the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. The flaw is triggered when processing specific protocol-valid route advertisements associated with EVPN-VPWS services.\nSuccessful exploitation allows a remote, configured BGP/EVPN peer to achieve arbitrary code execution with root privileges on Junos OS, or trigger a denial-of-service (DoS) condition leading to an rpd crash on Junos OS Evolved. The vulnerability resides in the packet parsing logic for BGP updates, making it a high-risk security flaw for service provider and enterprise network infrastructure.\nAn attacker must be in a position to establish a BGP/EVPN peering session with the target device. Because the exploitation relies on protocol-compliant advertisements, existing authentication mechanisms for BGP sessions may not be sufficient to block the attack if the peer is already trusted or compromised. The impact ranges from total system compromise and unauthorized control plane manipulation to service-wide routing instability.",
  "technicalDetails": "The vulnerability originates from insufficient bounds checking during the deserialization and processing of BGP/EVPN route attributes within the rpd process. Specifically, when the daemon parses incoming BGP Update messages containing EVPN-VPWS service information, it fails to adequately validate the length of data fields before copying them into a fixed-size stack-allocated buffer.\nThe attack flow commences with the attacker establishing a BGP session with the vulnerable Juniper device. Once the session is active, the attacker sends a crafted BGP Update message formatted as a valid EVPN-VPWS route advertisement. This message contains specifically constructed attributes designed to exceed the size of the destination stack buffer within the rpd memory space.\nDuring the execution of the parsing function, the overflow overwrites adjacent memory on the stack, which includes the saved return pointer or function pointers. By precisely crafting the overflow payload, an attacker can redirect the instruction pointer to arbitrary memory locations. On systems running Junos OS, this typically facilitates arbitrary code execution with root-level privileges, as the rpd process often operates with elevated system permissions.\nOn Junos OS Evolved, the underlying architecture and process isolation mechanisms may limit the outcome to an unrecoverable exception leading to a process crash, effectively resulting in a denial-of-service condition for the routing control plane. Since the overflow occurs in a network-facing component, the attack surface is exposed to any configured BGP peer.\nKey factors contributing to this vulnerability include the lack of robust input sanitization in the EVPN-VPWS parsing routine and the use of unsafe memory copy operations in the C-based rpd code. This vulnerability does not require complex heap grooming, as the overflow is stack-based, making it highly reliable for an attacker possessing the ability to send BGP updates to the target device. Post-exploitation, an attacker can install persistent backdoors, intercept traffic, or manipulate the global routing table by controlling the BGP process."
}