Arista EOS: malformed RPKI-RTR Error Report causes out-of-bounds read, crashing the RPKI agent or leaking memory to logs

CVSS 8.3CVE-2026-121292Firmware, BMC & network fabriccurated

Impact

A malformed RPKI-to-Router Error Report makes EOS read past the packet boundary. This can kill the RPKI agent, which stops origin validation, or write unintended memory contents into logs. It affects a much wider range of EOS releases than CVE-2026-121291, going back to 4.24.0F. Only switches with RPKI configured and an established RPKI-RTR session are affected.

Who can reach it

An attacker who can send RPKI-RTR protocol messages to the switch: a malicious or compromised RPKI cache, or someone who can inject into the RTR session. No authentication to the switch is needed. Devices without RPKI configured are not reachable this way.

What to do

Upgrade EOS to a fixed release: 4.36.3M+, 4.35.7M+, 4.34.9M+ or 4.33.11M+. The advisory lists no fix for 4.37.0F or for End of Support trains (4.24.0F onward); confirm with Arista TAC. This needs a switch image upgrade and reload, so plan for redundant paths. Arista says no mitigation is available, short of not running RPKI.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-121292 https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.