CVE-2026-102052 Junos OS and Junos OS Evolved: An attacker causes jdhcpd to crash when the DHCPv4 local-client feature is used

A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause denial of service or execute arbitrary code with root privileges via a malformed DHCPv4 server response when the DHCPv...

CVE-2026-102050 Junos OS and Junos OS Evolved: An adjacent attacker causes Layer 2 control-plane denial of service when LLDP is enabled

A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP. Repeated...

CVE-2026-102050

A Stack-based Buffer Overflow vulnerability exists in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved . An unauthenticated adjacent attacker can cause a denial of service in Layer 2 control-plane processing by sending malicious LLDP packets to an interface configured for LLDP. ...

EUVD-2026-101374

A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP. Repeated...

CVE-2026-102050 Junos OS and Junos OS Evolved: An adjacent attacker causes Layer 2 control-plane denial of service when LLDP is enabled

A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP. Repeated...

CVE-2026-102049 Junos OS and Junos OS Evolved: An attacker causes l2cpd crash or root code execution when Unified Access Policy is enabled

A Stack-based Buffer Overflow vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service or execute arbitrary code with root privileges via LLDP traffic received on an interface with Unified Access...

EUVD-2026-101373

A Stack-based Buffer Overflow vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service or execute arbitrary code with root privileges via LLDP traffic received on an interface with Unified Access...

CVE-2026-102049

A Stack-based Buffer Overflow vulnerability exists in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved . An adjacent unauthenticated attacker can exploit this by sending LLDP traffic to an interface where Unified Access Policy is enabled. Successful exploitation can lead to a d...

CVE-2026-102049 Junos OS and Junos OS Evolved: An attacker causes l2cpd crash or root code execution when Unified Access Policy is enabled

A Stack-based Buffer Overflow vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service or execute arbitrary code with root privileges via LLDP traffic received on an interface with Unified Access...

EUVD-2026-101352

An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to cause an rpd crash via BGP labeled-unicast UPDATEs when the affected multipath features are enabled...

CVE-2026-102027 Junos OS and Junos OS Evolved: A configured BGP neighbor causes rpd crash when multipath next-hops are processed

An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to cause an rpd crash via BGP labeled-unicast UPDATEs when the affected multipath features are enabled...

CVE-2026-75085 Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver

The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154stm32wba.c computed the packet length of a received frame as pktlen = rxframe-length - IEEE802154FCSLENGTH without first checking that the radio-reported length could hold an FCS. pktlen is a uint8t, so a reported length of 0 or 1...

EUVD-2026-101342

The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154stm32wba.c computed the packet length of a received frame as pktlen = rxframe-length - IEEE802154FCSLENGTH without first checking that the radio-reported length could hold an FCS. pktlen is a uint8t, so a reported length of 0 or 1...

CVE-2026-75084

The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in getpacketlength and validates it in verifyrxfifovalidity drivers/ieee802154/ieee802154cc1200.c. That validation only enforced a lower bound pktlen data and then calls netbufadd with t...

EUVD-2026-101341

The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in getpacketlength and validates it in verifyrxfifovalidity drivers/ieee802154/ieee802154cc1200.c. That validation only enforced a lower bound pktlen data and then calls netbufadd with t...

CVE-2026-75084

The TI CC1200 IEEE 802.15.4 driver contains an out-of-bounds write vulnerability in drivers/ieee802154/ieee802154_cc1200.c. The root cause is insufficient validation of the PHY packet length from the radio's RX FIFO in verify_rxfifo_validity(), which fails to bound large values when the radio is ...

CVE-2026-75084 Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet length

The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in getpacketlength and validates it in verifyrxfifovalidity drivers/ieee802154/ieee802154cc1200.c. That validation only enforced a lower bound pktlen data and then calls netbufadd with t...

CVE-2026-75084 Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet length

The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in getpacketlength and validates it in verifyrxfifovalidity drivers/ieee802154/ieee802154cc1200.c. That validation only enforced a lower bound pktlen data and then calls netbufadd with t...

CVE-2026-75084 Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet length

The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in getpacketlength and validates it in verifyrxfifovalidity drivers/ieee802154/ieee802154cc1200.c. That validation only enforced a lower bound pktlen data and then calls netbufadd with t...

EUVD-2026-101339

The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41zrx in drivers/ieee802154/ieee802154kw41z.c, computed the payload size as pktlen = len - KW41ZFCSLENGTH in a uint8t, where len is the frame length reported by the radio. The interrupt handler kw41zisr obtained that length from the...