Junos rpd: malformed LDP Label Mapping message crashes rpd or executes arbitrary code

Impact

A malformed LDP Label Mapping message from an adjacent LDP peer overflows a stack buffer in rpd, crashing the routing daemon or executing arbitrary code. No authentication is involved - LDP adjacency is enough. On fabrics that run MPLS between datacenter sites this is a link-adjacent path to the control plane of the device carrying inter-site training and checkpoint traffic.

Who can reach it

An unauthenticated attacker adjacent on a link where LDP is enabled, able to form or spoof an LDP session. Not reachable from outside that L2/L3 adjacency.

What to do

Upgrade Junos OS / Junos OS Evolved per Juniper JSA112187 for the fixed releases; the upgrade reboots the device. Where LDP is not needed on an interface, disabling it there removes the exposure for that link; LDP authentication and strict control of which interfaces accept LDP reduce who can reach the parser.

References

Related entries

• Junos OS Evolved na-grpcd: unauthenticated gRPC subscription request crashes the telemetry daemonCVE-2026-102012 · Juniper Junos OS Evolved na-grpcd (gRPC telemetry subscription)High
• Junos OS: stack overflow in authd gives root on the device to whoever controls the RADIUS serverCVE-2026-102014 · Juniper Junos OS authd (RADIUS response parsing)High
• Junos secure-dot1xd: EAPOL frame on an 802.1X interface gives root code executionCVE-2026-102015 · Juniper Junos OS / Junos OS Evolved secure-dot1xd (EAPOL frame handling)High
• Junos rpd: BGP MVPN signaling update from a configured peer crashes the routing daemonCVE-2026-102016 · Juniper Junos OS / Junos OS Evolved rpd (BGP MVPN signaling)High
• Junos rpd: BGP-LS updates hit a reachable assertion and crash the routing daemonCVE-2026-102020 · Juniper Junos OS / Junos OS Evolved rpd (BGP-LS NLRI processing)High
• Junos OS Evolved fwstatsd: SNMP firewall-counter query crashes the statistics daemonCVE-2026-102023 · Juniper Junos OS Evolved fwstatsd (SNMP firewall-counter MIB)High