Junos sdxd: heap overflow on the SDX/SRC connection yields root code execution on the device

Impact

An attacker who controls or can intercept the configured SDX/SRC server connection can send a crafted frame over the service-deployment TCP session and execute code as root on the device, or crash sdxd. Because the trust here is placed in an outbound management connection, anyone in a position to man-in-the-middle that path - a compromised management host or a foothold on the management network - inherits root on fabric hardware. Only devices configured for service deployment are affected.

Who can reach it

An attacker who controls the SDX/SRC server, or who can intercept or spoof the service-deployment TCP connection from the device. No device authentication is needed; the attacker needs network position on that path.

What to do

Upgrade Junos OS / Junos OS Evolved to a release listed in Juniper JSA112187; the fixed versions are in that advisory. The upgrade requires a device reboot per switch or router. Where service deployment is not actually used, removing the sdxd configuration removes the exposure immediately; where it is used, restrict and authenticate the path to the SDX/SRC server.

References

Related entries

• Junos OS on MX: stack overflow in kmd gives unauthenticated root via IKE certificate packetsCVE-2026-102182 · Juniper Junos OS kmd on MX Series (IKE certificate-based packet handling)Critical
• Phala dcap-qvl - the Rust/npm/Python DCAP quote verification library used to verify Intel SGX and TDX attestationCVE-2026-22696 · Phala dcap-qvl - the Rust/npm/Python DCAP quote verification library used to verify Intel SGX and TDX attestation…Critical
• Junos OS on SRX: stack overflow in srxpfe gives unauthenticated root code execution via a crafted GRE packetCVE-2026-33792 · Juniper Junos OS on SRX Series (srxpfe, GRE tunnel packet handling)Critical
• Voltronic Power SNMP Web Pro: unauthenticated firmware upload yields root on the UPS management cardCVE-2026-44402 · Voltronic Power SNMP Web Pro 1.1 (upload.cgi firmware update endpoint)Critical
• fakefish: KubeVirt backend ignores Redfish credentials, exposing VM power and virtual mediaCVE-2026-71566 · fakefish (Redfish BMC shim, KubeVirt backend)Critical
• Linux kernel (drivers/infiniband/hw/bnxt_re): A user context could request the write-combine doorbell page repeatedlyCVE-2026-72495 · Linux kernel (drivers/infiniband/hw/bnxt_re)Critical