Junos OS EUVD-2026-101376

Exploitation requires three concrete conditions: (1) the affected Junos OS or Junos OS Evolved device must be configured to use the DHCPv4 local-client feature (the device itself acting as a DHCP client) - this is the explicit 'when the DHCPv4 local-client feature is used' prerequisite and is not a universal default; (2) the attacker must occupy an adjacent network position (AV:A) - same L2 segment / broadcast domain or otherwise able to inject a DHCPv4 server response, such as via a rogue or spoofed DHCP server - meaning this is not internet-exploitable from arbitrary remote hosts; and (3) the attacker sends a malformed DHCPv4 server response to the jdhcpd process. No authentication or user interaction is needed (PR:N/UI:N). Limiting factors: devices not using DHCPv4 local-client, or isolated from untrusted adjacent networks, are not exposed; reliable arbitrary code execution (vs. DoS crash) is further constrained by platform stack protections.

This is a credible mid-to-high priority issue for organizations running Juniper Junos OS / Junos OS Evolved with the DHCPv4 local-client feature enabled, but it is NOT a universal emergency. The CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N, VC:H/VI:H/VA:H) confirms an adjacent, low-complexity, unauthenticated path to full compromise of the affected device, and the description's 'execute arbitrary code with root privileges' aligns with the high confidentiality/integrity/availability impact. However, two factors materially lower real-world risk: (1) AV:A means the attacker must be on the same L2/adjacent network segment as the victim (e.g., spoofing or operating a rogue DHCPv4 server), not reachable from the general internet; and (2) exploitation requires the non-default DHCPv4 local-client feature to be configured. No EPSS score, CISA KEV listing, or public POC is present in the provided data - so there is no public exploit identified at time of analysis, and no evidence of active exploitation. The SSVC-style signals (adjacent vector, config-dependent, root-level technical impact) point to a 'patch promptly where the feature is in use' posture rather than drop-everything. Note the stack-based overflow (CWE-121) with RCE potential makes reliable exploitation plausible but not trivial given modern stack protections; the vendor rates it 8.7 primarily on impact, not on exploitation likelihood.

An attacker positioned on an adjacent network segment (for example, a compromised host or rogue device on the same L2 broadcast domain as a Junos device acting as a DHCPv4 client) sends a malformed DHCPv4 server response. The crafted response triggers a stack-based buffer overflow in the jdhcpd process, crashing the daemon for denial of service or potentially executing attacker-controlled code as root. No public exploit code is identified at time of analysis, and successful RCE would require defeating stack protections on the target platform.