Junos OS EUVD-2026-101446

Exploitation requires the device to be running the OSPF routing protocol and the attacker to hold OSPF adjacency (or reachability within the OSPF/L2 adjacency domain) with the vulnerable rpd daemon - this is the AV:A Adjacent constraint, not arbitrary remote access. No authentication or user interaction is needed (PR:N/UI:N) once adjacency exists. Limiting factors: devices not configured for OSPF are not exposed; the attacker must be a (prospective) OSPF neighbor, so blast radius is confined to the routing segment; and affected products are specific Junos OS and Junos OS Evolved versions below the fixed releases listed in JSA112187 (e.g. <23.2R2-S7.7, <24.2R2-S5.5, <25.2R2-S2 and the corresponding -EVO builds).

This is a moderate-priority network infrastructure vulnerability rather than a mass-exploitation emergency. The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) indicates an adjacent, low-complexity, unauthenticated attack with no user interaction, but the AV:A (Adjacent) constraint is the dominant risk limiter: the attacker must be an established or adjacent OSPF peer, not an arbitrary remote host, which sharply narrows the viable attacker population to the routing/L2 adjacency domain. Impact is primarily availability - the vendor rates VA:H (full rpd crash) with SA:L (limited subsequent routing-plane impact). There is a notable internal inconsistency: the description explicitly states the flaw can 'disclose rpd memory' (a confidentiality impact), yet the vendor's vector sets VC:N - the published vector appears to under-represent the memory-disclosure path and should be verified against JSA112187. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active exploitation; the practical risk is a capable adversary with routing adjacency causing a routing-daemon denial of service or leaking process memory. Overall: a real but conditional risk for networks running OSPF on Juniper devices, not a drop-everything internet-facing bug.

An attacker who has achieved OSPF adjacency with a vulnerable Junos/Junos Evolved device - for example via a compromised peer router or a foothold on the same routing segment - sends specially malformed OSPF packets to the rpd process. The malformed input triggers improper quantity validation, crashing rpd (disrupting routing convergence) or leaking rpd process memory. No public exploit code is identified at time of analysis, and exploitation requires network adjacency rather than arbitrary remote reachability.