CVE-2026-102055: CWE-121 Stack-based Buffer Overflow in Juniper Networks Junos OS

This vulnerability is a stack-based buffer overflow (CWE-121) in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms. It can be triggered remotely by an unauthenticated attacker on an adjacent network through a specially crafted CFM message sent to a down-MEP configured with enhanced CFM mode. Exploitation can lead to arbitrary code execution with root privileges or denial of service. The affected versions span multiple release trains and include both standard and evolved OS variants. The vulnerability is assigned CVE-2026-102055 with a CVSS v3.1 score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No known exploits in the wild have been reported. The vendor has not provided explicit patch links in the input data, and the product is not a cloud service.

An unauthenticated attacker on an adjacent network can exploit this vulnerability to execute arbitrary code as root or cause a denial of service on affected Junos OS devices. This can lead to full system compromise or service disruption on MX Series and PTX Series platforms running vulnerable versions of Junos OS with enhanced CFM mode enabled on down-MEPs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no explicit patch links or vendor advisory content were provided, users should monitor Juniper Networks' official security advisories for updates. Until a patch is applied, consider disabling enhanced CFM mode on down-MEPs if feasible to reduce exposure.