CVE-2026-102045 in Junos OS Evolved
Summary
by MITRE • 10/14/2026
An Out-of-bounds Write Out-of-bounds Write vulnerability in lacpd of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to cause a denial of service via a crafted frame received on an LACP-enabled aggregated-Ethernet member port.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The identified vulnerability represents a critical memory corruption flaw within the Link Aggregation Control Protocol daemon, known as lacpd, in Juniper Networks Junos OS Evolved. This specific issue is classified as an Out-of-bounds Write, which falls under the Common Weakness Enumeration category CWE-787 and aligns with ATT&CK technique T1499 Endpoint Denial of Service via resource exhaustion or corruption. The root cause lies in insufficient boundary checks during the processing of Link Aggregation Control Protocol frames on aggregated-Ethernet member ports that have LACP enabled. When a Layer-2 adjacent attacker sends a specially crafted frame, the lacpd process fails to validate the length and structure of incoming packets against expected buffer limits. This lack of validation allows malicious data to be written beyond the allocated memory boundaries associated with the protocol handler's internal structures.
The operational impact of this vulnerability is primarily centered on service disruption rather than remote code execution or privilege escalation, although the potential for exploitation varies based on system configuration and patch levels. By triggering a buffer overflow within the lacpd process, an attacker can cause the daemon to crash or become unresponsive. Since LACP is essential for maintaining link aggregation groups that provide bandwidth load balancing and redundancy across multiple physical links, compromising this service directly impacts network stability. The resulting denial of service manifests as intermittent connectivity loss, flapping interfaces, or a complete failure of the aggregated Ethernet port group, thereby degrading the availability of critical network infrastructure services dependent on these high-availability link configurations.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. The primary defense is to apply the vendor-provided software updates that address this specific memory safety issue within the lacpd component. Organizations should prioritize patching systems where LACP-enabled aggregated-Ethernet ports are exposed to untrusted or semi-trusted network segments, particularly those accessible by Layer-2 adjacent attackers who can inject traffic into the broadcast domain. Additionally, implementing strict access control lists on switch interfaces and disabling unnecessary LACP features on ports that do not require link aggregation can reduce the attack surface. Network segmentation strategies should also be employed to isolate critical infrastructure from potential threat sources, ensuring that even if an attacker gains Layer-2 adjacency, they cannot easily reach vulnerable management planes or protocol daemons without traversing additional security controls such as firewalls or intrusion detection systems configured for deep packet inspection of control plane traffic.