409405 matches found
EUVD-2026-101352
An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to cause an rpd crash via BGP labeled-unicast UPDATEs when the affected multipath features are enabled...
CVE-2026-102027 Junos OS and Junos OS Evolved: A configured BGP neighbor causes rpd crash when multipath next-hops are processed
An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP neighbor to cause an rpd crash via BGP labeled-unicast UPDATEs when the affected multipath features are enabled...
CVE-2026-75085 Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver
The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154stm32wba.c computed the packet length of a received frame as pktlen = rxframe-length - IEEE802154FCSLENGTH without first checking that the radio-reported length could hold an FCS. pktlen is a uint8t, so a reported length of 0 or 1...
EUVD-2026-101342
The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154stm32wba.c computed the packet length of a received frame as pktlen = rxframe-length - IEEE802154FCSLENGTH without first checking that the radio-reported length could hold an FCS. pktlen is a uint8t, so a reported length of 0 or 1...
CVE-2026-75084 Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet length
The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in getpacketlength and validates it in verifyrxfifovalidity drivers/ieee802154/ieee802154cc1200.c. That validation only enforced a lower bound pktlen data and then calls netbufadd with t...
CVE-2026-75084 Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet length
The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in getpacketlength and validates it in verifyrxfifovalidity drivers/ieee802154/ieee802154cc1200.c. That validation only enforced a lower bound pktlen data and then calls netbufadd with t...
CVE-2026-75084
The TI CC1200 IEEE 802.15.4 driver contains an out-of-bounds write vulnerability in drivers/ieee802154/ieee802154_cc1200.c. The root cause is insufficient validation of the PHY packet length from the radio's RX FIFO in verify_rxfifo_validity(), which fails to bound large values when the radio is ...
CVE-2026-75084
The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in getpacketlength and validates it in verifyrxfifovalidity drivers/ieee802154/ieee802154cc1200.c. That validation only enforced a lower bound pktlen data and then calls netbufadd with t...
EUVD-2026-101341
The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in getpacketlength and validates it in verifyrxfifovalidity drivers/ieee802154/ieee802154cc1200.c. That validation only enforced a lower bound pktlen data and then calls netbufadd with t...
CVE-2026-75084 Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet length
The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of the radio's RX FIFO in getpacketlength and validates it in verifyrxfifovalidity drivers/ieee802154/ieee802154cc1200.c. That validation only enforced a lower bound pktlen data and then calls netbufadd with t...
EUVD-2026-101339
The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41zrx in drivers/ieee802154/ieee802154kw41z.c, computed the payload size as pktlen = len - KW41ZFCSLENGTH in a uint8t, where len is the frame length reported by the radio. The interrupt handler kw41zisr obtained that length from the...
CVE-2026-75083
The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41zrx in drivers/ieee802154/ieee802154kw41z.c, computed the payload size as pktlen = len - KW41ZFCSLENGTH in a uint8t, where len is the frame length reported by the radio. The interrupt handler kw41zisr obtained that length from the...
CVE-2026-102015 Junos OS and Junos OS Evolved: An attacker causes root code execution when 802.1X authentication is used
A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an EAPOL frame sent to an 802.1X-authenticated interface...
EUVD-2026-101335
A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an EAPOL frame sent to an 802.1X-authenticated interface...
CVE-2026-102015
A Heap-based Buffer Overflow vulnerability exists in the secure-dot1xd process of Juniper Networks running Junos OS and Junos OS Evolved . An unauthenticated adjacent network attacker can exploit this by sending a malicious EAPOL frame to an 802.1X-authenticated interface. Successful exploitation...
CVE-2026-102015 Junos OS and Junos OS Evolved: An attacker causes root code execution when 802.1X authentication is used
A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an EAPOL frame sent to an 802.1X-authenticated interface...
CVE-2026-102014 Junos OS: An attacker causes authd to crash when subscriber RADIUS authentication is used
A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root privileges via a malicious RADIUS response...
EUVD-2026-101334
A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root privileges via a malicious RADIUS response...
CVE-2026-102014
A Stack-based Buffer Overflow vulnerability exists in the authd process of Juniper Networks Junos OS . An attacker who can influence a configured RADIUS server can cause the authd process to crash or execute arbitrary code with root privileges by sending a malicious RADIUS response. No specific e...
CVE-2026-102014 Junos OS: An attacker causes authd to crash when subscriber RADIUS authentication is used
A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root privileges via a malicious RADIUS response...