Description

A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or cause a denial of service via a crafted packet received on a configured GRE tunnel.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T17:18:27.933Z",
  "pubdate": "2026-10-14T17:18:27.933Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability exists within the srxpfe process of Juniper Networks Junos OS on SRX Series devices. This vulnerability allows an unauthenticated, remote attacker to execute arbitrary code with root privileges or induce a denial of service (DoS) condition.\nThe flaw originates from improper boundary validation during the processing of GRE (Generic Routing Encapsulation) tunnel packets. If a specifically crafted packet is received, it triggers a memory corruption event on the stack of the srxpfe process. Successful exploitation provides the attacker with full control over the affected system, bypassing authentication and authorization mechanisms.\nGiven that the srxpfe process operates with root-level privileges, the impact of a successful exploit is total system compromise. The vulnerability is highly severe as it requires no prior authentication and can be triggered by sending malicious traffic to an SRX device configured with GRE tunnels. Organizations must treat this as a high-priority risk, as it allows for persistent unauthorized access and complete disruption of network security services provided by the SRX platform.",
  "technicalDetails": "The vulnerability resides in the srxpfe (SRX Packet Forwarding Engine) process, which is responsible for handling network traffic and protocol-specific processing within Juniper Junos OS. The root cause is a stack-based buffer overflow occurring during the decapsulation or parsing of GRE tunnel packets. When the srxpfe process attempts to copy received packet data into a fixed-length stack buffer without performing adequate bounds checking, a memory corruption event is triggered.\nThe attack flow begins when an attacker sends a crafted GRE packet to an SRX device that has at least one GRE tunnel configured. The vulnerability is exposed because the srxpfe process parses the GRE header and subsequent payload using unsafe memory management routines. By crafting a packet with an oversized payload or malicious header fields, an attacker can overwrite adjacent memory locations on the stack. This overwrite can corrupt the saved return address or local function variables, redirecting the execution flow to attacker-controlled memory.\nBecause the srxpfe process runs with root privileges to manage hardware-level packet forwarding and security policies, the exploitation of this buffer overflow grants the attacker the same elevated authority. An attacker can leverage this primitive to execute shellcode or perform Return-Oriented Programming (ROP) to bypass system protections such as ASLR or NX bits if implemented. If the attacker chooses not to inject code, they can deliberately cause a crash by triggering an invalid memory access or stack pointer corruption, leading to an immediate denial of service of the srxpfe process, which forces the device to reboot or hang, thereby dropping all transit traffic.\nThe requirement for exploitation is limited to reaching the SRX device's GRE tunnel configuration via the network. No authentication is necessary, and the attacker does not need prior access to the management plane of the device. The payload is delivered encapsulated within standard GRE traffic, which may bypass basic stateful inspection firewalls if the GRE protocol itself is permitted. The technical impact includes complete system compromise, potential exfiltration of sensitive routing data, or total service disruption within the network infrastructure."
}