Description

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T17:18:27.763Z",
  "pubdate": "2026-10-14T17:18:27.763Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability exists within the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved.\nThis vulnerability is triggered when the BGP Monitoring Protocol (BMP) is actively enabled, allowing an unauthenticated BGP peer to send specially crafted BGP route updates.\nSuccessful exploitation allows a remote attacker to induce a denial of service (DoS) by crashing the routing daemon or, more severely, achieve arbitrary code execution with root-level privileges.\nThe risk is categorized as critical due to the unauthenticated nature of the attack, the potential for total system compromise, and the necessity of the rpd process for core network infrastructure functionality.\nThe attack is remotely exploitable without valid credentials, leveraging the protocol's parsing logic to overwrite memory structures on the stack.\nUsers are advised to prioritize mitigation strategies that limit exposure to unauthorized BGP peers.",
  "technicalDetails": "The vulnerability resides in the memory management and packet parsing logic of the routing protocol daemon (rpd) specifically within the component responsible for processing BGP updates when the BGP Monitoring Protocol (BMP) is configured.\nAt its core, the flaw is a stack-based buffer overflow occurring during the sanitization or copy operation of incoming BGP update attributes. When a BGP peer transmits a maliciously crafted update, the rpd fails to properly validate the length of specific data fields before copying them into a fixed-size stack buffer.\nThe attack flow initiates when an unauthenticated BGP peer establishes a BGP session with the target device. Once the session is established, the attacker transmits a crafted BGP update packet containing an attribute payload that exceeds the pre-allocated stack buffer boundary.\nAs the rpd processes this update, the unchecked copy operation triggers the overflow, enabling the attacker to overwrite adjacent memory on the stack, including the saved return address or critical function pointers.\nBy precisely controlling the content of the overflow payload, an attacker can hijack the control flow of the rpd process. If the payload contains shellcode or a return-oriented programming (ROP) chain, the execution can be redirected to arbitrary instructions.\nBecause the rpd process typically operates with root-level privileges to perform low-level network operations and interface management, successful code execution results in a complete compromise of the routing device at the administrative level.\nIf the exploit payload is malformed or intentionally induces an access violation without providing valid instruction pointers, the immediate impact is a crash of the rpd, resulting in a denial of service. This forces the device to restart the routing process, potentially causing widespread network instability and traffic drops while the routing tables are re-converged.\nThe vulnerability is exposed network-wide to any node capable of establishing a BGP peering session with the Juniper device. No local access or prior authentication is required to initiate the exploitation sequence, making it highly attractive for remote threat actors targeting core infrastructure."
}