CVE-2026-102182 in Junos OS
Summary
by MITRE • 10/15/2026
A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.
This issue affects Junos OS on MX Series:
* All versions before 21.2R3-S11; * from 21.4 before 21.4R3-S12; * from 22.2 before 22.2R3-S8; * from 22.3 before 22.3R3-S5; * from 22.4 before 22.4R3-S9;
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
A critical stack-based buffer overflow vulnerability exists within the kmd component of Juniper Networks Junos OS, specifically impacting MX Series routers. This flaw allows an unauthenticated network attacker to achieve arbitrary code execution with root privileges by crafting and sending specific Internet Key Exchange (IKE) certificate-based packets. The vulnerability stems from improper bounds checking when processing incoming IKE messages that contain X.509 certificates. When the kmd daemon processes these malformed or excessively large certificate structures, it fails to validate the length of input data against the allocated stack buffer size. This lack of validation leads to a write operation that exceeds the boundaries of the designated memory space on the call stack, overwriting adjacent memory locations including return addresses and saved frame pointers.
The technical nature of this flaw classifies as CWE-121, which denotes a stack-based buffer overflow. In the context of network-facing services like IKE, such vulnerabilities are particularly dangerous because they can be exploited remotely without requiring any prior authentication credentials. The attacker constructs packets that trigger the specific code path within kmd responsible for parsing certificate data. By carefully crafting the payload to include shellcode or ROP gadgets in the buffer overflow region and manipulating the overwritten return address, an attacker can redirect the execution flow of the process. Since kmd operates with high privileges necessary for key management tasks, successful exploitation results in full system compromise at the root level.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1059, Command and Scripting Interpreter, as it enables initial access through remote code execution. Furthermore, it relates to MITRE CWE-787, Out-of-bounds Write, which is the underlying mechanism allowing memory corruption. The operational impact of exploiting this flaw is severe, granting attackers complete control over the affected router. This can lead to unauthorized network traversal, interception of encrypted traffic due to compromised key management processes, and use of the device as a pivot point for further attacks against internal infrastructure. It also poses significant risks to service availability if exploitation attempts cause crashes or instability in the routing engine.
Mitigation strategies primarily involve applying vendor-supplied patches that address the input validation logic within the kmd component. Administrators should upgrade Junos OS on MX Series devices to versions 21.2R3-S11, 21.4R3-S12, 22.2R3-S8, 22.3R3-S5, or 22.4R3-S9 and later, as these releases contain fixes for the buffer overflow condition. In environments where immediate patching is not feasible, implementing strict access control lists to restrict IKE traffic from untrusted networks can reduce the attack surface. Additionally, enabling logging on security devices to monitor for anomalous IKE packet sizes or frequencies may aid in detecting exploitation attempts before successful compromise occurs. Regular vulnerability scanning and adherence to secure configuration baselines are essential components of a defense-in-depth strategy against such high-severity remote code execution flaws.