CVE-2026-102018 in Junos OS
Summary
by MITRE • 10/15/2026
A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed PIM Bidir message.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The identified vulnerability represents a critical security flaw within the Routing Protocol Daemon, commonly referred to as rpd, which is responsible for managing dynamic routing protocols in Juniper Networks Junos OS and Junos OS Evolved environments. This specific weakness manifests as a NULL pointer dereference, a type of memory corruption error that occurs when software attempts to access a memory address that has not been allocated or has been previously freed. In this context, the flaw is triggered by the processing of Protocol Independent Multicast Bidirectional (PIM-Bidir) messages. PIM-Bidir is an extension of the PIM protocol designed for efficient multicast traffic distribution in dense networks, allowing receivers to join a shared tree rooted at a rendezvous point without requiring source-specific joins. The vulnerability arises because the rpd process fails to adequately validate incoming PIM-Bidir packets before attempting to dereference pointers associated with their internal data structures.
An unauthenticated attacker positioned on an adjacent network segment can exploit this flaw by crafting and transmitting specially malformed PIM Bidir messages to the affected device. Because the attack vector requires only adjacency, it does not necessitate complex routing manipulation or authentication bypasses beyond what is already required for standard multicast protocol communication. The malicious payload exploits the lack of rigorous input validation within the message parsing logic. When the rpd process receives this malformed packet, it attempts to access memory locations based on fields that are either missing, null, or incorrectly formatted in the crafted message. This action results in a segmentation fault or similar critical error within the daemon's execution context.
The operational impact of this vulnerability is severe, primarily resulting in a denial-of-service condition for the affected device and potentially the broader network infrastructure it supports. When the rpd process crashes due to the NULL pointer dereference, the Junos OS instance typically restarts the service or, depending on system configuration and severity, may reboot entirely. This disruption leads to an immediate loss of routing table integrity and dynamic neighbor adjacencies for all protocols managed by that daemon, including OSPF, IS-IS, BGP, and PIM itself. For networks relying on multicast services such as IPTV, video conferencing, or distributed applications, this outage can cause significant service degradation. Furthermore, the instability introduced by repeated crashes can lead to resource exhaustion and increased CPU utilization during recovery phases, further degrading network performance.
From a classification perspective, this vulnerability aligns with CWE-476, which denotes NULL Pointer Dereference, indicating that the software performs an operation on a pointer without verifying that it is non-null first. In terms of offensive security frameworks, this exploit falls under MITRE ATT&CK technique T1498, Network Denial of Service, specifically within the sub-category of Resource Exhaustion via service disruption. The attack leverages the fundamental trust placed in adjacent network peers for routing protocol exchanges, highlighting a gap in input sanitization at the application layer rather than the transport or network layers.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. The primary defense is to apply the vendor-provided software patches that address the validation logic within the rpd process for PIM Bidir message handling. Organizations should prioritize updating all Junos OS and Junos OS Evolved instances exposed to untrusted or semi-trusted adjacent networks. In environments where patching cannot be immediately implemented, network segmentation is recommended to restrict access to routing protocol ports from non-essential devices. Additionally, implementing strict ingress filtering on border routers can help block malformed multicast traffic before it reaches the vulnerable rpd process. Monitoring for unusual spikes in PIM message volume or frequent daemon restarts via syslog analysis can also aid in early detection of exploitation attempts while mitigation efforts are underway.