CVE-2026-101968: CWE-191 Integer Underflow (Wrap or Wraparound) in Juniper Networks Junos OS

This vulnerability (CVE-2026-101968) involves an integer underflow (wrap or wraparound) in the rpd process of Juniper Networks Junos OS on certain platforms supporting draft Rosen MVPN, including EX Series, MX Series, and ACX Series running Junos OS Evolved. The flaw allows an unauthenticated adjacent attacker to cause heap memory disclosure and multicast join-state injection by sending a malformed Rosen-MVPN message. The affected versions span multiple release trains and subversions as detailed, with no patch information provided in the source data. The CVSS 3.1 base score is 5.4, indicating medium severity, with attack vector adjacent network, low attack complexity, no privileges required, and no user interaction needed. The impact includes limited confidentiality and integrity loss but no availability impact.

An unauthenticated adjacent attacker can exploit this integer underflow vulnerability to cause disclosure of heap memory contents and inject multicast join-state information. This may lead to partial leakage of sensitive information and unauthorized manipulation of multicast state. There is no indication of availability impact or requirement for user interaction or privileges. The overall impact is limited to confidentiality and integrity, rated medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no explicit patch or workaround information is provided, users should monitor Juniper Networks advisories for updates. Until a fix is available, restricting access to the affected services from adjacent networks and monitoring for malformed Rosen-MVPN messages may reduce exposure.