{"schemaVersion":3,"id":"CVE-2026-101981","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message.","dates":{"published":"2026-10-14T17:16:50.194Z","modified":"2026-10-16T14:18:50.553Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00245,"percentile":0.14774,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-15T00:00:00.000Z","score":0.00245,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00245,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00245,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00245,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00245,"percentile":0.14774}],"last30":[{"date":"2026-10-15T00:00:00.000Z","score":0.00245,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00245,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00245,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00245,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00245,"percentile":0.14774}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-121","name":"Stack-based Buffer Overflow","description":"A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).","type":"weakness","status":"Draft","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/121.html"}],"affected":[{"vendor":"juniper networks","product":"junos os","name":"Junos OS","label":"junos os","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 23.4, < 23.4R2-S8.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 24.2, < 24.2R2-S5.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 24.4, < 24.4R2-S5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 25.2, < 25.2R2-S2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 25.4, < 25.4R1-S3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 26.2, < 26.2R1-S2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 23.4, < 23.4R2-S8.13 | ≥ 24.2, < 24.2R2-S5.5 | ≥ 24.4, < 24.4R2-S5 | ≥ 25.2, < 25.2R2-S2 | ≥ 25.4, < 25.4R1-S3 | ≥ 26.2, < 26.2R1-S2","eol":null,"hubHref":"/vendor/juniper_networks/junos_os"},{"vendor":"juniper networks","product":"junos os evolved","name":"Junos OS Evolved","label":"junos os evolved","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 23.4, < 23.4R2-S8.11-EVO","noFixRecorded":false,"fixedIn":null},{"text":"≥ 24.2, < 24.2R2-S5.6-EVO","noFixRecorded":false,"fixedIn":null},{"text":"≥ 24.4, < 24.4R2-S5-EVO","noFixRecorded":false,"fixedIn":null},{"text":"≥ 25.2, < 25.2R2-S2-EVO","noFixRecorded":false,"fixedIn":null},{"text":"≥ 25.4, < 25.4R1-S3-EVO","noFixRecorded":false,"fixedIn":null},{"text":"≥ 26.2, < 26.2R1-S2-EVO","noFixRecorded":false,"fixedIn":null},{"text":"23.4X100","noFixRecorded":false,"fixedIn":null},{"text":"≥ 25.2X100, < 25.2X100-D35-EVO","noFixRecorded":false,"fixedIn":null},{"text":"≥ 25.4X300, < 25.4X300-D40-EVO","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 23.4, < 23.4R2-S8.11-EVO | ≥ 24.2, < 24.2R2-S5.6-EVO | ≥ 24.4, < 24.4R2-S5-EVO | ≥ 25.2, < 25.2R2-S2-EVO | ≥ 25.4, < 25.4R1-S3-EVO | ≥ 26.2, < 26.2R1-S2-EVO | 23.4X100 | ≥ 25.2X100, < 25.2X100-D35-EVO | ≥ 25.4X300, < 25.4X300-D40-EVO","eol":null,"hubHref":"/vendor/juniper_networks/junos_os_evolved"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://supportportal.juniper.net/JSA112187","label":"supportportal.juniper.net/JSA112187","hostname":"supportportal.juniper.net","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-14T17:16:50.194Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-16T14:18:50.553Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":35,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T10:07:12.249Z","stale":false,"partial":false}}