FRRouting CVE-2026-28532

Exploitation requires that the target FRRouting instance has OSPF enabled and is configured to run OSPF on at least one interface with an established adjacency to a neighbor (or network allowing the attacker to establish adjacency). The vulnerability is triggered specifically when Type 10 (Opaque LSA Link-local) or Type 11 (Opaque LSA Area-local) LSAs carrying TE or SR sub-TLVs are received and parsed. If OSPF TE (via mpls-te on) or Segment Routing extensions are not enabled in the OSPF configuration, the vulnerable parser functions may not be invoked, though this is not confirmed as an absolute protection. The attack vector is limited to adjacent network (AV:A) - the attacker must be able to send OSPF packets to the target, either by being on the same network segment or by establishing an OSPF neighbor relationship (which typically requires shared network/subnet and OSPF authentication if configured). Unauthenticated OSPF adjacency is possible on networks without OSPF authentication enabled, but authenticated adjacencies (MD5/HMAC) are common in enterprise deployments. The vulnerability does NOT require user interaction, elevated privileges, or authentication credentials; once adjacency is established, the mere receipt of a crafted LSA triggers the crash.

The CVSS 6.5 score (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a significant but constrained risk profile. The attack vector is adjacent network (AV:A), meaning the attacker must be on the same network segment or have established OSPF adjacency - this eliminates direct Internet-facing remote exploitation but is achievable within enterprise networks, data centers, or by compromising an OSPF neighbor. No privileges (PR:N) or user interaction (UI:N) are required once adjacency is established; the attack is automatic upon receipt of a crafted packet. The confidentiality impact is none (C:N) and integrity impact is none (I:N), but availability impact is high (A:H) - the router crashes. The vulnerability affects all FRRouting instances running OSPF with TE or SR enabled in a given area; a single attacker can cascade the denial across the entire autonomous system. The lack of reported CVSS confidentiality/integrity impacts aligns with the out-of-bounds read leading to crash rather than code execution. However, out-of-bounds memory reads in routing daemons can sometimes leak sensitive routing state before a crash occurs - this potential is not reflected in the CVSS but merits consideration. The vulnerability requires two specific conditions to fail: (1) the attacker must achieve OSPF adjacency (not trivial in all deployments), and (2) TE/SR parsing must be active. This significantly reduces real-world risk compared to the CVSS score alone. No EPSS score, KEV status, or public exploit code was provided, but vendor-released patches and upstream fixes are available, reducing the window of exposure for patched deployments.

An attacker with OSPF adjacency (e.g., a compromised router, VM, or container on the same network) crafts a malicious Type 10 or Type 11 Opaque LSA with sub-TLV length fields that cause integer truncation in the vulnerable FRRouting parser. When the crafted LS Update packet is received, the ospfd daemon processes the LSA, triggers the out-of-bounds memory read, and crashes. All routers running vulnerable FRRouting versions in the same OSPF area receive and process the same LSA via flooding, causing a cascading denial of service across the routing infrastructure. The attacker needs no special network position beyond OSPF adjacency and the attack is entirely deterministic given the crafted packet.