CVE-2026-102052 in Junos OS
Summary
by MITRE • 10/15/2026
A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause denial of service or execute arbitrary code with root privileges via a malformed DHCPv4 server response when the DHCPv4 local-client feature is used.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in this advisory represents a critical security flaw within the Juniper Networks Junos OS and Junos OS Evolved platforms, specifically affecting the jdhcpd process which handles Dynamic Host Configuration Protocol version 4 operations. This stack-based buffer overflow arises from improper bounds checking when processing DHCPv4 server responses, particularly when the local-client feature is enabled on a device interface. The core technical issue lies in how the application allocates and manages memory for incoming network packets; specifically, it fails to validate the length of certain fields within the DHCP message structure before copying them into fixed-size stack buffers. When an attacker sends a specially crafted DHCPv4 response containing oversized or malformed data structures, the excess data overflows the allocated buffer space on the call stack. This overflow corrupts adjacent memory locations, including critical control data such as return addresses and frame pointers, which are essential for maintaining the integrity of program execution flow.
From an operational perspective, this vulnerability allows an unauthenticated attacker positioned in the same network segment to exploit the flaw with severe consequences. Because the jdhcpd process typically runs with elevated privileges, successfully exploiting this buffer overflow grants the attacker code execution capabilities at the root level on the affected device. This means that a malicious actor can take complete control of the networking infrastructure managed by the Junos OS platform. The immediate impact includes denial of service conditions where the crash of the jdhcpd process disrupts DHCP services for other clients, but more critically, it enables arbitrary code execution. An attacker could install backdoors, exfiltrate sensitive network configuration data, pivot to attack internal systems behind the firewall, or use the compromised device as a launchpad for further attacks against adjacent hosts on the local subnet.
This vulnerability is categorized under CWE-121, which defines stack-based buffer overflow vulnerabilities resulting from writing more data to a fixed-length block of memory than it can hold. The exploitation vector aligns with MITRE ATT&CK technique T1498, Network Denial of Service, due to the potential for causing service disruption through process crashes, and potentially T1053, Scheduled Task/Job, if the attacker uses root privileges to persist their access by modifying system schedules or cron jobs. The requirement for an adjacent unauthenticated attacker highlights that this is a local network-based attack rather than one exploitable over wide-area networks unless specific routing conditions are met, emphasizing the importance of securing internal network segments and restricting DHCP traffic sources where possible.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. The primary defense is to apply the vendor-provided software patches or updates that address the buffer overflow by implementing proper input validation and bounds checking within the jdhcpd process. Organizations should prioritize updating all Junos OS and Junos Evolved devices where the DHCPv4 local-client feature is active, as this specific configuration path triggers the vulnerable code path. In environments where immediate patching is not feasible due to operational constraints, network segmentation controls such as Access Control Lists (ACLs) on routers or switches can restrict DHCP traffic sources to only trusted servers and authorized clients, thereby limiting exposure to unauthenticated adjacent attackers. Additionally, enabling logging for DHCP events allows security operations teams to detect anomalous packet sizes or malformed responses that may indicate exploitation attempts in progress. Regular vulnerability scanning of network infrastructure components is also recommended to ensure compliance with security baselines and timely identification of similar flaws across the estate.