CVE-2026-28532: FRRouting < 10.5.3 Integer Overflow in OSPF TLV Parser Functions
FRRouting < 10.5.3 Integer Overflow in OSPF TLV Parser Functions
Other sources
FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16t accumulator variable truncates uint32t values returned by the TLVSIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.
— NVD
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28532?
CVE-2026-28532 has been rated as a medium severity vulnerability due to the potential impact on OSPF Traffic Engineering and Segment Routing operations.
How do I fix CVE-2026-28532?
To fix CVE-2026-28532, upgrade to FRRouting version 10.5.3 or later where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-28532?
CVE-2026-28532 is an integer overflow vulnerability in the OSPF TLV parser functions.
Which versions of FRRouting are affected by CVE-2026-28532?
CVE-2026-28532 affects all versions of FRRouting prior to 10.5.3.
What component of FRRouting does CVE-2026-28532 impact?
CVE-2026-28532 impacts the OSPF Traffic Engineering and Segment Routing TLV parser functions within FRRouting.