Juniper Junos OS up to 25.2R1 on MX Log Message bbesmgd[] memory leak

Summaryinfo

A vulnerability marked as problematic has been reported in Juniper Junos OS up to 25.2R1 on MX. Affected by this issue is some unknown functionality of the component Log Message Handler. This manipulation of the argument bbesmgd[] causes memory leak. This vulnerability is handled as CVE-2026-33775. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Juniper Junos OS up to 25.2R1 on MX. It has been declared as critical. Affected by this vulnerability is an unknown code of the component Log Message Handler. The manipulation of the argument bbesmgd[] with an unknown input leads to a memory leak vulnerability. The CWE definition for the vulnerability is CWE-401. The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory. As an impact it is known to affect availability. The summary by CVE is:

A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS). If the authentication packet-type option is configured and a received packet does not match that packet type, the memory leak occurs. When all memory available to bbe-smgd has been consumed, no new subscribers will be able to login. The memory utilization of bbe-smgd can be monitored with the following show command: user@host> show system processes extensive | match bbe-smgd The below log message can be observed when this limit has been reached: bbesmgd[]: %DAEMON-3-SMD_DPROF_RSMON_ERROR: Resource unavailability, Reason: Daemon Heap Memory exhaustion This issue affects Junos OS on MX Series: * all versions before 22.4R3-S8, * 23.2 versions before 23.2R2-S5, * 23.4 versions before 23.4R2-S6, * 24.2 versions before 24.2R2-S2, * 24.4 versions before 24.4R2, * 25.2 versions before 25.2R2.

It is possible to read the advisory at kb.juniper.net. This vulnerability is known as CVE-2026-33775 since 03/23/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/10/2026). The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 22.4R3-S8, 23.2R2-S5, 23.4R2-S6, 24.2R2-S2, 24.4R2 or 25.2R2 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS

Version

• 22.4R3-S7
• 23.2R2-S4
• 23.4R2-S5
• 24.2R2-S1
• 24.4R1
• 25.2R1

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion