Junos OS EUVD-2026-101382

Requires the Junos OS device to be operating as a DHCP client (the flaw is in DHCP client response handling within jdhcpd), and the attacker must be able to deliver a crafted DHCP response - i.e., occupy an adjacent position on the same broadcast/L2 segment as the victim, matching the description's 'adjacent attacker'. No authentication or user interaction is needed (PR:N/UI:N). Limiting factors: devices not configured as DHCP clients (and not running relay/ZTP that depend on jdhcpd) are not exposed; the adjacency requirement means purely external/internet-based exploitation is unlikely despite the vendor's AV:N labeling; impact is confined to denial of service of DHCP, relay, and zero-touch-provisioning, with automatic recovery (R:A) once the malicious traffic stops.

This is a genuine but bounded availability risk. The vulnerability is a stack-based buffer overflow (CWE-121) in the jdhcpd process that an unauthenticated attacker (CVSS PR:N confirms no authentication) can trigger to cause denial of service. IMPORTANT DATA CONFLICT: the supplied CVSS 4.0 vector specifies AV:N (network), but the description explicitly states an 'adjacent attacker' - DHCP is inherently a layer-2/broadcast-domain protocol, so adjacent (AV:A) is the realistic vector; the AV:N labeling likely overstates remote reachability and should be verified against JSA112188. Impact is availability-only (VC:N/VI:N/VA:H, SA:L) - there is no confidentiality or integrity exposure, so this cannot lead to code execution or data theft despite being a memory-corruption bug; the vendor modeled it strictly as a crash. EPSS is not provided, the CVE is NOT in CISA KEV, and no public exploit is referenced, so there is no evidence of active exploitation or weaponization. Net: a credible DoS against network infrastructure that warrants prompt patching where DHCP services run on exposed segments, but it is not a drop-everything critical given the adjacency requirement, availability-only impact, and absence of exploitation signals. The 8.7 score is driven largely by the (questionable) AV:N and high availability impact.

An attacker positioned on the same broadcast domain as a Junos OS device acting as a DHCP client crafts a malformed DHCP response that overflows a stack buffer in the jdhcpd process, crashing it. This interrupts DHCP, DHCP relay, and zero-touch-provisioning services on the device, degrading network provisioning and connectivity. No public exploit is identified at time of analysis, and the attacker needs adjacent network access rather than full remote reach.