BIRD Routing Daemon CVE-2026-112112

Requires an established, authenticated BGP peering session with the target BIRD instance (PR:L) - not open to arbitrary internet hosts. Unicast-route validation must be enabled on the receiving flow6 channel, which is the exact configuration in which the flawed zero-filled-prefix reconstruction accepts an overly broad rule. The attacking peer must also be advertising a suitable unicast route that the reconstructed prefix can validate against (the AT:P attack requirement). For downstream impact, the BIRD instance's export policy must permit propagating the FlowSpec rule to downstream peers, and those downstream devices must enforce it. Limiting factors: trusted/authenticated peer required, validation-enabled flow6 channel, dependency on a matching unicast route, and permissive export policy - absent any of these the issue does not materialize.

All signals point to a genuinely LOW-priority issue rather than a high-CVSS-but-low-risk mismatch. The vendor-supplied CVSS 4.0 base score is 2.3 (Low); the vector AV:N/AC:L/AT:P/PR:L/UI:N shows network reach but with a required precondition (AT:P) and an authenticated foothold (PR:L), and the only impact is VI:L (limited integrity) with VC:N/VA:N and no subsequent-system impact (SC:N/SI:N/SA:N). No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical barrier is high: the attacker must already be an established, trusted BGP peer, validation must be enabled on the flow6 channel, and a suitable unicast route plus permissive export policy must exist for any downstream impact. The input tag 'Authentication Bypass' conflicts with the data - exploitation presumes an already-authenticated BGP session (PR:L), so this is a FlowSpec/unicast-route validation bypass (CWE-1284), not an authentication bypass; treat that tag as mislabeled. Net: low urgency, patch during normal maintenance.

An attacker operating an established, authenticated BGP peer crafts an IPv6 FlowSpec rule whose destination-prefix component uses a nonzero offset so it matches IPv6 addresses outside the peer's authorized address space. Because BIRD validates a reconstructed, zero-filled prefix (contrary to RFC 8956 section 5) against a suitable unicast route the peer legitimately advertises, the overly broad rule passes validation and, where export policy permits, is propagated to downstream peers, causing unauthorized traffic filtering or redirection. No public proof-of-concept was identified.