Juniper Junos OS EUVD-2026-101451

Exploitation requires the target Junos OS or Junos OS Evolved device to have an established BGP-LS peering session with the traffic-engineering address family explicitly enabled - this is not a default configuration. The attacker must itself be a configured BGP-LS peer (an existing routing trust relationship), so the attack surface is limited to adjacent, already-peered devices rather than arbitrary remote hosts. Further limiting factors: High attack complexity per the CVSS vector (the malformed UPDATE must reliably trigger the length inconsistency), and the impact is confined to disclosure of small amounts of rpd heap memory with no integrity or availability effect.

This is a genuinely low-priority issue, and the multiple signals agree rather than conflict. The vendor-assigned CVSS 3.1 base score is only 3.1 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N): the attack vector is Adjacent (not Internet-wide Network), attack complexity is High, and the only impact is Low confidentiality - no integrity or availability loss, and no scope change. Although the vector lists PR:N, the description makes clear the attacker must already be a *configured BGP-LS peer*, i.e. operate inside an established BGP trust relationship, which is a meaningful real-world barrier that PR:N understates. No EPSS score, SSVC decision, KEV listing, or POC was supplied in the input; there is no KEV entry and no public exploit identified at time of analysis, consistent with a low-value heap-disclosure bug that leaks small amounts of adjacent memory rather than enabling code execution or DoS. Net assessment: low real-world risk - patch during normal maintenance cycles, not as an emergency.

An attacker who already controls or has compromised a device that is a configured BGP-LS peer of a Junos/Junos OS Evolved router (with the traffic-engineering address family enabled on that session) sends a specially malformed BGP UPDATE message. The length-handling flaw in rpd causes it to return adjacent heap memory contents to the peer, disclosing small fragments of process memory. No public exploit code was identified at time of analysis, and the High attack complexity plus required peer relationship make opportunistic exploitation unlikely.