CVE-2026-102176: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Juniper Networks Junos OS

This vulnerability is a classic buffer overflow (CWE-120) in the SDK service process of Juniper Networks Junos OS. An unauthenticated attacker can exploit this by sending crafted packets to the affected service, leading to denial of service or full compromise of the Routing Engine. The issue occurs only when both the SDK service and a JDAF routing instance are enabled. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability affects multiple version ranges of Junos OS prior to certain patch releases.

Successful exploitation can lead to denial of service or compromise of the Routing Engine, impacting the availability, integrity, and confidentiality of the affected system. The attacker does not require authentication or user interaction, increasing the risk of remote exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Users should monitor Juniper Networks advisories for updates and apply patches once available. Until then, consider disabling the SDK service or JDAF routing instance if feasible to reduce exposure.