CVE-2026-102180

HighCVSS 7.5/10Last modified Oct 15, 2026

Description

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a crafted BGP route attribute, which is processed while a BGP RIB streaming telemetry subscription is active.

This issue does not affect Junos OS versions prior to 22.1R1. This issue does not affect Junos OS Evolved versions prior to 22.1R1-EVO.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-121

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Juniper Networks	Junos OS	< 23.2R2-S7.7; >= 23.4, < 23.4R2-S8.13; >= 24.2, < 24.2R2-S5.5; >= 24.4, < 24.4R2-S5; >= 25.2, < 25.2R2-S2; >= 25.4, < 25.4R1-S3; >= 26.2, < 26.2R1-S2
Juniper Networks	Junos OS Evolved	< 23.2R2-S7.7-EVO; >= 23.4, < 23.4R2-S8.11-EVO; >= 24.2, < 24.2R2-S5.6-EVO; >= 24.4, < 24.4R2-S5-EVO; >= 25.2, < 25.2R2-S2-EVO; >= 25.4, < 25.4R1-S3-EVO; >= 26.2, < 26.2R1-S2-EVO; 23.4X100; >= 25.2X100, < 25.2X100-D35-EVO; >= 25.4X300, < 25.4X300-D40-EVO

References

https://supportportal.juniper.net/JSA112187

Timeline

Published: Oct 14, 2026
Last modified: Oct 15, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1021829.8A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network CVE-2026-1021837.5An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Ju CVE-2026-1021847.5An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Ju CVE-2026-1021857.5A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and CVE-2026-1021864.7Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.CVE-2026-1021875.5Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2026-1021886.8Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-1021897.0Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-102197.3A vulnerability was found in nextlevelbuilder GoClaw up to 3.11.3. This impacts the function FsBridge.WriteFile of the file internal/sandbox CVE-2026-1021917.0Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-1021927.5Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.CVE-2026-1021937.0Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.