---
id: CVE-2026-101981
title: >-
  A Stack-based Buffer Overflow vulnerability in the routing protocol daemon
  (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an
  unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary
  code via a malforme…
summary: >-
  A Stack-based Buffer Overflow vulnerability in the routing protocol daemon
  (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an
  unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary
  code via a malforme…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-121
vendor: Juniper Networks
product: Junos OS
affected:
  - junos_os >= 23.4 < 23.4R2-S8.13
  - junos_os >= 24.2 < 24.2R2-S5.5
  - junos_os >= 24.4 < 24.4R2-S5
  - junos_os >= 25.2 < 25.2R2-S2
  - junos_os >= 25.4 < 25.4R1-S3
  - junos_os >= 26.2 < 26.2R1-S2
  - junos_os_evolved >= 23.4 < 23.4R2-S8.11-EVO
  - junos_os_evolved >= 24.2 < 24.2R2-S5.6-EVO
  - junos_os_evolved >= 24.4 < 24.4R2-S5-EVO
  - junos_os_evolved >= 25.2 < 25.2R2-S2-EVO
  - junos_os_evolved >= 25.4 < 25.4R1-S3-EVO
  - junos_os_evolved >= 26.2 < 26.2R1-S2-EVO
  - junos_os_evolved 23.4X100
  - junos_os_evolved >= 25.2X100 < 25.2X100-D35-EVO
  - junos_os_evolved >= 25.4X300 < 25.4X300-D40-EVO
published: '2026-10-14'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:16:59.740'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-101981'
references:
  - url: 'https://supportportal.juniper.net/JSA112187'
    label: sirt@juniper.net
tags:
  - nvd
  - cve.org
epss: 0.00245
epssPercentile: 0.15712
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T03:56:47.341770Z'
ingestedAt: '2026-10-14T18:47:39.304Z'
---

## Overview

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.