CVE-2026-28532 is an integer overflow vulnerability in FRRouting (frr) before version 10.5.3. The flaw exists in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator truncates uint32_t values returned by the TLV_SIZE() macro. This truncation causes the loop termination condition to fail, allowing pointer advancement beyond intended bounds. Exploitation requires an attacker to have an established OSPF adjacency and involves sending a crafted LS Update packet with malicious Type 10 or Type 11 Opaque LSA. Successful exploitation results in out-of-bounds memory reads and crashes of affected routers in the OSPF area or autonomous system.

Exploitation of this vulnerability can cause out-of-bounds memory reads and crash all affected routers within the OSPF area or autonomous system. This disrupts network routing availability and stability. There is no indication of privilege escalation or data disclosure beyond the crash impact. No known exploits in the wild have been reported.

No official patch or remediation level has been confirmed at this time. Users should monitor the FRRouting project advisories for updates and apply patches once available. Until a fix is released, restricting OSPF adjacency to trusted devices and monitoring OSPF traffic for anomalies may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.