Junos OS CVE-2026-101946

Exploitation requires the vulnerable router to be running LDP with IPv6 enabled on the control path, and the attacker must occupy an adjacent (same-segment / directly peered) network position able to deliver an IPv6 LDP message to the rpd process - this is not remotely reachable across the internet (AV:A). Limiting factors: the adjacency requirement confines exploitation to insiders or an already-compromised neighboring device; routers not running LDP or not processing IPv6 LDP messages are not exposed. The description labels the attacker 'low-privilege' while the vendor CVSS sets PR:N, so the exact authentication/privilege prerequisite should be confirmed against JSA112187. Impact is limited to disclosure of small amounts of rpd memory and disruption of a single LDP adjacency.

This is a moderate-severity, limited-impact issue rather than a top-tier priority. The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) scores 5.3 and indicates low-complexity exploitation from an adjacent network position with no privileges, but with only limited confidentiality impact (VC:L) and no integrity or availability impact recorded (VI:N/VA:N) - notably, VA:N conflicts with the description's claim that the flaw can 'disrupt an LDP adjacency,' which is an availability effect that the vector does not capture. There is also a privilege conflict: the description characterizes the attacker as 'adjacent low-privilege,' yet the CVSS vector sets PR:N (no privileges) - verify the true privilege requirement with the vendor advisory. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' The adjacency requirement (AV:A) materially limits real-world risk: an attacker must already be on the same L2 segment / LDP peering path, which constrains this to insiders or an already-compromised adjacent device rather than remote internet-based mass exploitation. Net assessment: a genuine but contained bug warranting routine patching on affected routers, not emergency response.

An attacker positioned on an adjacent network segment that participates in LDP peering sends a crafted IPv6 LDP message to a vulnerable Junos/Junos Evolved router, triggering an out-of-bounds read in the rpd routing process. This leaks limited fragments of rpd process memory and can tear down the LDP adjacency, disrupting label-switched-path signaling. No public exploit code is identified at time of analysis, and exploitation requires adjacent access to the LDP control path.