CWE-121: Stack-based Buffer Overflow vulnerabilities

CVE-2026-33792 is a critical stack-based buffer overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series devices. It allows an unauthenticated network attacker to execute code as root or cause a denial of service by sending a crafted packet on a configured GRE tunnel. The vulnerability affects multiple Junos OS versions prior to specific patch releases. The CVSS score is 9.8, indicating a high severity with network attack vector, no privileges or user interaction required, and impacts confidentiality, integrity, and availability.

CVE-2026-33789 is a critical stack-based buffer overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated BGP peer to cause denial of service and potentially execute root-level commands via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases. The CVSS v3.1 score is 9.8, indicating a critical severity level.

CVE-2026-102182 is a critical stack-based buffer overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series devices. It allows an unauthenticated network attacker to execute code as root by sending specially crafted IKE certificate-based packets. The vulnerability requires IKE to be enabled with an RSA-signature IKE policy to be exploitable. Multiple versions of Junos OS on MX Series are affected, specifically versions before certain fixed releases in the 21.x through 26.x release trains.

CVE-2026-102180 is a stack-based buffer overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows an attacker with access to a configured BGP peering session to cause a denial of service by sending a specially crafted BGP route attribute during an active BGP RIB streaming telemetry subscription. This vulnerability affects multiple versions of Junos OS and Junos OS Evolved starting from 22.1R1 and later, up to certain patched releases. The vulnerability has a high severity rating with a CVSS score of 7.5.

CVE-2026-102178 is a critical stack-based buffer overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved. It allows a configured BGP flowspec peer to cause routing-engine compromise or routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases.

CVE-2026-102174 is a stack-based buffer overflow vulnerability in the iked IKE key-management daemon of Juniper Networks Junos OS on the SRX Series. It allows an authenticated remote-access VPN client to execute code with root privileges or cause a denial of service. The vulnerability affects multiple Junos OS versions prior to specific patch releases. The CVSS score is 8.8, indicating high severity.

CVE-2026-102061 is a stack-based buffer overflow vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved. It allows an adjacent unauthenticated attacker to execute arbitrary code as root by sending a crafted DHCP SZTP bootstrap message. This vulnerability affects only platforms that support Secure-ZTP. The issue has a high severity with a CVSS score of 8.8.

CVE-2026-102057 is a stack-based buffer overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS. It allows an unauthenticated adjacent attacker to cause a denial of service by sending a crafted DHCP client response. This affects DHCP client operations and can disrupt DHCP, relay, and zero-touch-provisioning services. The vulnerability has a high severity with a CVSS score of 7.5. Multiple versions of Junos OS prior to specific patch releases are affected. No known exploits are reported in the wild at this time.

CVE-2026-102055 is a stack-based buffer overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms. It allows an unauthenticated adjacent-network attacker to execute arbitrary code as root or cause denial of service by sending a specific CFM message to a configured down-MEP with enhanced CFM mode enabled. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS v3.1 base score is 8.8, indicating high severity.

CVE-2026-102052 is a stack-based buffer overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS and Junos OS Evolved platforms. It can be triggered by an adjacent unauthenticated attacker via a malformed DHCPv4 server response when the DHCPv4 local-client feature is enabled. Successful exploitation may lead to denial of service or arbitrary code execution with root privileges. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved as specified. The CVSS v3.1 base score is 8.8, indicating high severity.

CVE-2026-102050 is a stack-based buffer overflow vulnerability in the l2cpd daemon of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated adjacent attacker to cause a denial of service by sending crafted LLDP packets to an interface configured for LLDP. This can disrupt LLDP and other Layer 2 control protocols on the device. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific fixed releases. The CVSS v3.1 score is 8.8, indicating high severity.

CVE-2026-102049 is a stack-based buffer overflow vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved. It allows an adjacent unauthenticated attacker to cause denial of service or execute arbitrary code with root privileges via LLDP traffic on interfaces with Unified Access Policy enabled. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific fixed releases. The CVSS 3.1 score is 8.8, indicating high severity.

CVE-2026-102014 is a stack-based buffer overflow vulnerability in the authd process of Juniper Networks Junos OS. An attacker who can influence a configured RADIUS server may cause the authd process to crash or execute code with root privileges by sending a malicious RADIUS response. The vulnerability affects multiple versions of Junos OS prior to specific patch releases. The CVSS score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability.

CVE-2026-101990 is a critical stack-based buffer overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It allows a remote configured BGP peer to cause an rpd crash or, on Junos OS, remote code execution by sending a specially crafted flow-spec update selected for re-advertisement. The vulnerability affects multiple versions of Junos OS and Junos OS Evolved prior to specific patch releases. The CVSS score is 9.8, indicating a critical severity with network attack vector, low complexity, no privileges required, and impacts confidentiality, integrity, and availability. No known exploits in the wild have been reported. Patch status is not confirmed in the provided data; users should consult Juniper Networks advisories for remediation details.

CVE-2026-101955 is a high-severity stack-based buffer overflow vulnerability in the UTM Anti-Spam SBL feature of Juniper Networks Junos OS on SRX series devices. It allows an unauthenticated remote attacker to cause arbitrary code execution or denial of service by sending a malformed DNS packet when Anti-Spam SBL inspection is enabled.

CVE-2026-102069 is a high-severity stack-based buffer overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices configured as Junos Fusion Aggregation Devices. It can be triggered by an adjacent attacker acting as the configured ICCP peer when dot1x synchronization is enabled for the required Fusion satellite topology. Successful exploitation may cause denial of service and potentially allow execution of code with root privileges.

CVE-2026-102068 is a high-severity stack-based buffer overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved. It allows an unauthenticated remote attacker to cause a kernel panic by sending a specially crafted TCP packet when key-chain authentication is enabled for BGP or LDP. This vulnerability affects multiple versions of Junos OS Evolved prior to specific patch releases. No known exploits are reported in the wild at this time.

CVE-2026-76655 is a high severity stack-based buffer overflow vulnerability in Hewlett Packard Enterprise's HPE NonStop SNMP Trap Multiplexer. This flaw may allow remote code execution without requiring privileges or user interaction. The vulnerability impacts availability but does not affect confidentiality or integrity according to the CVSS vector. No affected versions or patch information are provided.

CVE-2026-101341 is a high-severity stack-based buffer overflow vulnerability in NLnet Labs NSD affecting versions 4.10.0 up to but not including 4.15.3. The flaw arises because tokens of text in RDATA, such as in TXT records under 32 bytes, are not properly checked against the reserved space, allowing out-of-bounds stack writes. This can overwrite a callback function pointer that NSD calls immediately after parsing. The vulnerability requires feeding specially crafted zone files directly to NSD, such as those from an operator-controlled provisioning system, rather than those written out by NSD itself.

CVE-2026-101339 is a high-severity stack-based buffer overflow vulnerability in NLnet Labs NSD affecting versions from 4.10.0 up to but not including 4.15.3. It occurs when a HIP resource record with a near-limit RDATA size and an additional dname RDATA field (HIP Rendezvous server) is processed, allowing up to 191 bytes of attacker-controlled data to overwrite the stack. This vulnerability requires feeding a specially crafted zone file directly to NSD, such as from an operator-controlled provisioning system. Zone files written out by NSD itself are not vulnerable to this formatting issue.