EUVD-2026-81010
GHSA-m8c5-pmmq-7x3q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain L2 access to affected VLAN
-
DeliveryCraft malformed IGMP packet
-
ExploitSend to trigger OOB read in snooping agent
-
ExecutionAgent terminates, multicast floods all ports
-
ImpactRepeat to sustain multicast forwarding loss
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires IGMP snooping to be active on the target VLAN, which per the description is enabled by DEFAULT on all VLANs in Arista EOS - so most deployments are affected out of the box. The attacker must be network-ADJACENT (AV:A): they need L2 access to send packets on an affected VLAN (compromised host, rogue device, or insider on the switched segment), so this is NOT exploitable from arbitrary remote/internet locations. No authentication (PR:N) and no user interaction (UI:N) are needed. The primary limiting factors are the adjacency requirement and the impact ceiling: the effect is a temporary, self-recovering disruption of multicast forwarding (traffic floods rather than being blackholed), and sustained impact requires repeated exploitation. |
| Impact | This is a genuine but bounded availability risk, not a critical priority. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) confirms a network-adjacent, unauthenticated, low-complexity attack with no user interaction - meaning any attacker with a foothold on an affected VLAN (a compromised host, rogue device, or malicious insider) can trigger it trivially. However, the impact is strictly availability (VC:N/VI:N/VA:H): the IGMP snooping agent crashes and multicast forwarding degrades to flooding until the service recovers. There is no confidentiality or integrity loss, so despite the CWE-125 (out-of-bounds read) classification, this behaves as a denial-of-service, not an information leak. No EPSS score, CISA KEV listing, or public POC was provided, so no exploitation-probability or active-exploitation signal is available. The AV:A (adjacent, not network) restriction is the key mitigating factor - this cannot be launched from arbitrary remote networks, only from the local L2 broadcast/VLAN domain - which meaningfully limits real-world exposure and argues against treating this as an urgent internet-facing threat. Note the input Tags claim 'Information Disclosure,' which conflicts with the vendor CVSS (VC:N); treat this as DoS only. |
| Exploit ScenarioDerived | An attacker with L2 access to an affected VLAN (e.g., a compromised endpoint or rogue device on the switched segment) crafts and sends malformed IGMP packets to the Arista EOS switch. The IGMP snooping agent hits the out-of-bounds read and terminates, collapsing multicast forwarding state so multicast traffic floods every port on the VLAN until the agent restarts. By repeatedly sending the malformed packets the attacker sustains the disruption, causing prolonged loss of intended multicast forwarding. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Malformed IGMP packets sent by a network-adjacent, unauthenticated attacker can terminate the IGMP snooping agent on Arista EOS switches, causing multicast traffic to flood to all ports of the affected VLAN until the agent recovers. Because IGMP snooping is enabled by default on all VLANs in EOS, most deployments are exposed out of the box, but the attacker needs Layer 2 adjacency to a target VLAN (a compromised host, rogue device, or insider on the switched segment) rather than arbitrary internet reachability, and the impact is a bounded, self-recovering availability disruption that must be repeatedly triggered to be prolonged. No public exploit code and no confirmed active exploitation were identified at time of analysis; the realistic risk is a genuine but non-critical availability concern rather than a priority-one emergency.
RemediationAI
Patch status is not confirmed from the available input data - no fixed EOS version, commit, or PR was supplied - so the immediate action is to consult Arista Security Advisory 0159 (https://www.arista.com/en/support/advisories-notices/security-advisory/24715-security-advisory-0159) and apply the vendor-designated EOS upgrade for the affected release train as soon as it is published; do not assume any specific version number that is not stated in that advisory. If no patched image is available yet, the most direct compensating control is to disable IGMP snooping on VLANs that do not require multicast optimization, which removes the vulnerable parser from the attack surface, at the cost of permanently flooding multicast to all ports of those VLANs - the same forwarding behaviour seen during the failure, but deterministic and without the control-plane restart. Reduce the Layer 2 adjacency prerequisite by hardening access ports: enforce port security or 802.1X on edge ports, disable unused ports, and use DHCP snooping/ARP inspection and BPDU guard so a rogue or compromised device cannot inject frames onto a multicast VLAN; these controls add operational overhead and can break BYOD or unmanaged-device workflows if applied too broadly. Where edge filtering is feasible, restrict which ports may source IGMP (and consider rate-limiting or ACL-filtering IGMP traffic at the access edge) so only legitimate querier-adjacent interfaces can drive the snooping agent, noting that aggressive IGMP filtering can itself disrupt legitimate multicast join/leave processing. Finally, monitor syslog and SNMP for IGMP snooping agent restarts or unexpected multicast flooding to detect repeated exploitation attempts that would otherwise extend the outage window.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IGMP snooping is a Layer 2 control-plane feature in which the switch inspects IGMP membership reports and leaves between hosts and multicast routers so that multicast group traffic is forwarded only to ports that requested it, instead of being flooded across the whole broadcast domain. In Arista EOS this agent is enabled by default on every VLAN (CPE and platform enumeration were not supplied in the source data beyond the vendor advisory), so the vulnerable parsing path is reachable on essentially any VLAN carrying IGMP traffic. The assigned root-cause class is CWE-125 (Out-of-Bounds Read), consistent with a parser that fails to validate packet length or field boundaries in a malformed IGMP message and reads past the end of the received buffer, which faults the process and terminates the snooping agent. The accompanying tags ("Buffer Overflow", "Information Disclosure") suggest the malformed-packet handling was flagged as a memory-safety issue, but the assessed impact for this CVE is availability-only (C:N/I:N/A:H in the CVSS 3.1 assessment; the vendor's CVSS 4.0 vector likewise shows VC:N/VI:N/VA:H), so there is no confirmed disclosure or modification primitive - the observable effect is agent termination and, until restart, a fallback to unknown-unicast-style flooding of multicast frames to all ports in the VLAN.
Know when Arista gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Adjacent VLAN access (AV:A), unauthenticated and low-complexity against default IGMP snooping (PR:N/AC:L), pure availability impact on multicast forwarding (C:N/I:N/A:H).
Primary rating from Vendor (arista).
CVSS VectorVendor: arista
DescriptionCVE.org
On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the IGMP snooping agent to terminate unexpectedly. This results in a temporary disruption of multicast traffic management, which may cause multicast traffic to be flooded to all ports of the affected VLAN until the service recovers. Repeated exploitation could result in a prolonged loss of intended multicast forwarding behavior.
Executive ViewAI
A high-severity availability flaw in Arista EOS can cause the IGMP snooping process on affected switches to terminate when it receives malformed IGMP traffic, briefly flooding multicast traffic across every port in the affected VLAN. Because IGMP snooping is enabled by default on EOS, the exposure footprint is likely to include most of the organization's Arista switching estate, but an attacker must already have a foothold or rogue device on the same Layer 2 segment - this is not exploitable from the internet. The net effect is a recurring, self-recovering multicast disruption that can degrade IPTV, market data, voice/video, and other multicast-dependent services until the agent restarts, making this a meaningful operational resilience issue rather than a data-breach or emergency-patch scenario.
No vendor-released patch identified at time of analysis. Interim mitigations: disable IGMP snooping on VLANs that do not require multicast; segregate untrusted endpoints (guest, IoT, contractor, BYOD) from multicast-dependent VLANs via Layer 2 segmentation; disable unused switch ports and enforce port security, DHCP snooping, dynamic ARP inspection, and BPDU guard; apply multicast storm control and rate limiting on access ports; monitor switch logs for IGMP snooping agent restarts and multicast flooding as indicators of repeated triggering; engage Arista TAC for a hotfix or vendor-supported workaround.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Command injection vulnerability in VeloCloud Orchestrator (VCO) on-premises allows unauthenticated remote attackers to a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly oth
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential d
Exploit-DB