Junos OS EUVD-2026-101416

Exploitation requires that LDP (Label Distribution Protocol, used for MPLS label signaling) be configured and enabled on the target Junos OS or Junos OS Evolved device, and that the attacker occupy the position of an adjacent LDP peer able to send the device a malformed LDP Label Mapping message. No authentication is required (PR:N), but the attack vector is Adjacent (AV:A), not Network - the attacker must have Layer-2/directly-reachable LDP adjacency rather than arbitrary remote internet reach. Devices not running LDP/MPLS, or whose LDP peers are all trusted and segmented, are not exposed. This limits realistic risk to MPLS-enabled routers in service-provider and large enterprise cores.

This is a credible high-priority issue for organizations running MPLS, but not an internet-wide emergency. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H, score 8.7) indicates an adjacent (not fully remote) attacker with no authentication and low complexity can achieve high confidentiality, integrity and availability impact - consistent with the description's claim of rpd crash or arbitrary code execution. The critical limiting signal is AV:A: the attacker must be an adjacent LDP peer, so exploitation requires a direct LDP/MPLS peering relationship rather than arbitrary internet reachability, which substantially narrows the exposed population to the MPLS control plane. No EPSS probability was provided in the input, so exploitation likelihood cannot be quantified; there is no CISA KEV listing and no public exploit referenced, so this is not confirmed as actively exploited. No SSVC decision data was supplied. Net: treat as a real patch priority for any Junos/Junos OS Evolved device participating in LDP, but the adjacency requirement and absence of KEV/POC/EPSS signals argue against mass opportunistic exploitation at this time.

An attacker who controls or compromises a device in an LDP peering relationship with a vulnerable Junos router sends a crafted, malformed LDP Label Mapping message to the target. The malformed message overflows a stack buffer in the routing protocol daemon (rpd), crashing the daemon (disrupting routing) or potentially executing attacker-controlled code. No public exploit identified at time of analysis; exploitation requires adjacent network position as an LDP peer, not remote internet access.