Junos OS EUVD-2026-101338

Exploitation requires that the Auto-RP mapping feature (PIM sparse-mode Auto-RP, used for dynamic rendezvous-point discovery) be explicitly enabled on the Junos OS / Junos OS Evolved device - this is a non-default configuration and is the primary limiting factor. The attacker must also be on an adjacent network segment within the PIM multicast domain to deliver the Auto-RP mapping announcements (CVSS AV:A), not reachable from the general internet. No authentication is required (PR:N) and no user interaction is needed (UI:N). Devices not running PIM Auto-RP mapping are not exploitable regardless of version.

This is a moderate-priority availability issue, not a critical emergency. The vendor-assigned CVSS 4.0 vector (score 7.1) specifies adjacent attack vector (AV:A), low complexity (AC:L), no privileges (PR:N) and no user interaction (UI:N), with impact limited to availability (VA:H / SA:L) and zero confidentiality or integrity impact - consistent with the described routing-plane denial of service rather than code execution, despite the CWE-787 out-of-bounds write classification. The AV:A rating is the key limiter: exploitation requires the attacker to be on the adjacent (link-local multicast) network segment where Auto-RP mapping announcements are processed, not the open internet, which substantially narrows the realistic attacker population to those with a foothold in the routing domain. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. A further gating factor is configuration: the flaw is only reachable when Auto-RP mapping is enabled, which is not a universal default. Net assessment: a legitimate patch-worthy bug for networks running PIM Auto-RP, but the combination of adjacent-only access, availability-only impact, non-default feature requirement, and absence of exploitation signals places it below internet-facing unauthenticated RCE priorities.

An attacker positioned on a network segment adjacent to a Junos OS or Junos OS Evolved router that has Auto-RP mapping enabled sends crafted Auto-RP mapping announcement packets into the PIM multicast domain. The malformed announcement triggers an out-of-bounds write in the rpd (routing protocol daemon) process, crashing the routing plane and causing a denial of service. No public exploit code is identified in the available data, and exploitation requires adjacent-network access rather than remote internet reach.