EUVD-2026-101327
GHSA-wg4p-r223-jpr2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent network / PIM adjacency access
-
ExploitSend crafted PIM Join/Prune messages
-
ExecutionTrigger use-after-free in rpd daemon
-
ImpactCrash routing daemon (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target Junos OS or Junos OS Evolved device be configured for sparse-mode PIM (Protocol Independent Multicast); devices without PIM sparse mode configured are not affected. The attacker must have Adjacent (AV:A) network position - i.e., be on the same broadcast/routing segment with a valid PIM adjacency to the device - so purely remote, routed-internet attackers cannot reach the vulnerable code path directly. No authentication and no user interaction are required (PR:N/UI:N). The primary limiting factors are the mandatory PIM-sparse-mode configuration (non-default for many deployments) and the adjacency requirement, which together confine realistic exploitation to attackers already present on multicast-enabled segments. |
| Impact | This is a genuine but conditional availability risk rather than a top-tier emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes an unauthenticated, low-complexity attack with no user interaction, which raises concern - but the attack vector is Adjacent (AV:A), not Network, meaning the attacker must already be on the same L2 segment / routing adjacency, which significantly narrows the realistic attacker population to insiders, compromised adjacent devices, or attackers with physical/segment access. Impact is availability-only (VC:N/VI:N/VA:H, SA:L) - a routing daemon (rpd) crash / denial of service, with no confidentiality or integrity loss and no code execution. Exploitation is further gated on a non-default prerequisite: PIM sparse mode must be configured. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization. Net: a credible DoS against multicast-enabled Juniper routers that warrants prompt patching in environments running PIM sparse mode, but the adjacent-only vector plus the configuration dependency keep it below the priority of a remotely exploitable, network-reachable flaw. No signals conflict here; the main limiting factors are the AV:A adjacency requirement and the PIM configuration dependency. |
| Exploit ScenarioDerived | An attacker positioned on an adjacent network segment that participates in PIM routing sends specially crafted PIM Join/Prune messages to a Junos OS or Junos OS Evolved device configured for sparse-mode PIM. The malformed messages trigger a use-after-free in the rpd routing daemon, crashing it and disrupting routing/multicast forwarding. No public exploit code is identified at time of analysis, and the Adjacent (AV:A) vector means the attacker must already have L2/routing-adjacency reachability to the target. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Adjacent, unauthenticated attackers can crash the rpd routing protocol daemon on Juniper Networks Junos OS and Junos OS Evolved devices that are configured for sparse-mode PIM, exploiting a use-after-free flaw triggered by specific PIM Join/Prune messages. Successful exploitation causes a denial of service through daemon failure and subsequent routing churn, with no impact on confidentiality or integrity. Exploitation is conditional: the target must run PIM sparse mode and the attacker must already sit on an adjacent multicast/routing segment with a valid PIM adjacency, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vendor advisory JSA112187 is the authoritative source for affected and fixed releases.
RemediationAI
Because the vulnerable code path requires sparse-mode PIM and a valid PIM adjacency, the primary action is to consult Juniper advisory JSA112187 (https://supportportal.juniper.net/JSA112187) and upgrade the device to the fixed Junos OS or Junos OS Evolved release specified there for the relevant release train; the exact fixed version is not derivable from the supplied data, so do not assume a generic 'latest' build is the vendor-designated fix without confirming against that advisory. If PIM sparse mode is not operationally required, disabling it removes the exposure entirely, at the cost of losing multicast routing on that device. Where PIM-SM must remain enabled, reduce the attack surface by restricting PIM adjacencies to trusted neighbors: apply interface firewall filters that permit PIM (IP protocol 103) only from known, statically defined neighbor addresses on the multicast-enabled interfaces, and drop PIM from any segment where untrusted hosts reside; the trade-off is that overly tight filters can block legitimate PIM neighbor formation and delay multicast convergence, so filters must be validated against the deployed multicast topology and neighbor set before rollout. Also consider isolating multicast-enabled interfaces into a dedicated routing instance with no untrusted adjacencies, and monitor rpd core files, crash logs, and unexpected daemon restarts as indicators of attempted or successful exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in the PIM Join/Prune handling code of rpd, the Juniper routing protocol daemon that implements routing protocols including Protocol Independent Multicast on Junos OS and Junos OS Evolved. In PIM Sparse Mode (PIM-SM), routers exchange Join/Prune messages toward a Rendezvous Point to build and tear down shared and shortest-path distribution trees; processing malformed or specially crafted Join/Prune messages can cause rpd to reference memory that has already been freed, leading to memory corruption and a daemon crash. The affected component set is identified by CPEs for the junos_os and junos_os_evolved product families; the wildcard version fields in the provided CPE data mean the exact vulnerable release ranges are not resolvable from this feed and must be taken from the vendor advisory. The vendor-supplied CVSS 4.0 score is 7.1 with the vector AV:A/AC:L/AT:N/PR:N/UI:N and high availability impact plus low subsequent-system availability impact, which aligns with the independent assessment of CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H: an unauthenticated, no-interaction attack that is only reachable from an adjacent network position, not from arbitrary routed-internet sources, and whose only consequence is loss of availability of the routing daemon.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M
Adjacent PIM adjacency required (AV:A), no auth or interaction (PR:N/UI:N); rpd crash disrupts routing beyond the daemon itself (S:C) with availability-only impact (A:H).
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
4DescriptionCVE.org
A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to crash the routing daemon via specific PIM messages when sparse mode PIM is configured.
Executive ViewAI
Juniper Networks Junos OS and Junos OS Evolved devices configured for sparse-mode PIM are exposed to a high-severity denial-of-service condition that can crash the rpd routing daemon and cause routing churn. Exploitation is conditional: an attacker must already have access to an adjacent multicast/routing segment and a valid PIM adjacency, but a successful attack could degrade network availability for organizations relying on these devices. No vendor-released patch is available, and no public exploit identified at time of analysis, so leadership should prioritize exposure reduction and monitoring while awaiting vendor guidance in JSA112187.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting PIM adjacencies to trusted routing segments, disabling PIM sparse mode where not required, applying interface ACLs or filters to block unauthorized PIM Join/Prune traffic, monitoring rpd process stability and routing churn, and following any workarounds in JSA112187.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB