CVE-2026-102177: Junos OS and Junos OS Evolved: An out-of-bounds write causes an rpd crash when IS-IS backup selection is used
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 23.2R2-S7.7-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 23.4R2-S8.11-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 24.2R2-S5.6-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 24.4R2-S5-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.2R2-S2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.2X100-D35-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.4R1-S3-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.4R2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 25.4X300-D40-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 26.2R1-S2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 26.2R2-EVO - Upgrade
Upgrade
Juniper Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 26.4R1-EVO - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 23.2R2-S7.7 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 23.4R2-S8.13 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 24.2R2-S5.5 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 24.4R2-S5 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 25.2R2-S2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 25.4R1-S3 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 25.4R2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 26.2R1-S2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 26.2R2 - Upgrade
Upgrade
Juniper Junos OSto a version that resolves this vulnerability.Fixed in 26.4R1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Devices running Junos OS or Junos OS Evolved are exposed when IS-IS link protection and backup-selection are configured. Exploitation requires an attacker adjacent to the affected device; no authentication or user interaction is required.
What is the impact of successful exploitation?
An attacker can trigger an out-of-bounds write in the routing protocol daemon (rpd), causing rpd to crash and resulting in a denial of service. The provided severity vector also indicates potential low confidentiality and integrity impact.
Are default configurations affected?
The issue is described as requiring both IS-IS link protection and backup-selection to be configured. The provided information does not state whether those features are enabled by default.
What can be done if patching cannot happen immediately?
The available information identifies IS-IS link protection and backup-selection as required conditions for exploitation. Review whether both are configured and, where operationally feasible, avoid that affected feature combination until remediation is available.