A malformed Error Report can cause EOS to read beyond packet boundaries, potentially terminating the RPKI agent or exposing unintended memory contents through logging.
Arista EOS deployments running an RPKI agent are the relevant exposure scope, because the malformed Error Report is processed by that agent. The provided data does not identify affected EOS versions or specific configurations.
The vector is network-based, with low attack complexity and no required privileges or user interaction. An attacker would need to deliver a malformed Error Report to the affected RPKI agent.
Successful processing of a malformed Error Report can make the RPKI agent terminate, affecting availability. It may also cause unintended memory contents to be exposed through logging; the supplied severity vector indicates low confidentiality impact and no integrity impact.