{"id":"CVE-2026-101982","published":"2026-10-14T18:17:13.120","lastModified":"2026-10-16T15:16:59.893","description":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)  of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-121"],"vendors":[],"products":[],"references":[{"url":"https://supportportal.juniper.net/JSA112187","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A stack-based buffer overflow in Juniper's routing protocol daemon (rpd) allows remote attackers to execute code as root or crash the system when processing valid BGP/EVPN route advertisements. This represents a critical vulnerability that can lead to full system compromise.","exploitability":"Exploitation is relatively straightforward as it requires only sending specially crafted EVPN-VPWS route advertisements from a configured BGP peer, with no additional authentication or privilege requirements needed.","blast_radius":"The vulnerability affects all Junos OS and Junos OS Evolved devices running the rpd daemon that have BGP/EVPN configured, potentially impacting large network infrastructures with multiple routing points.","remediation":"Upgrade to Junos OS 23.4R3 or later, or Junos OS Evolved 23.4R3 or later to address this vulnerability.","detection":"Monitor for rpd process crashes in system logs, particularly around BGP peer connections and EVPN route advertisement events, and watch for unexpected restarts of the routing protocol daemon.","tags":["rce","network","routing","bgp","evpn"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:52:25.392Z"}}