CVE-2026-103994: Junos OS: A crafted OVSDB message crashes vgd and allows remote code execution
A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete outage of the OVSDB control plane and possibly remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Networks Junos OSto a version that resolves this vulnerability.Fixed in 23.2R2-S7.7
Event History
Frequently Asked Questions
What access would an attacker need to exploit this issue?
The attacker would need to act as, or compromise, an SDN controller capable of sending a crafted OVSDB message to the affected device. The CVSS vector indicates adjacent-network access and no required privileges or user interaction.
Which deployments should be prioritized for triage?
Prioritize Junos OS deployments using the VXLAN Gateway Daemon (vgd) and an OVSDB-controlled SDN environment. The affected control-plane path is the OVSDB connection between the SDN controller and the device.
What is the expected operational impact if exploitation succeeds?
A crafted message can cause a complete outage of the OVSDB control plane. The vulnerability may also permit remote code execution, with high confidentiality, integrity, and availability impact indicated by the supplied CVSS vector.