Junos OS on SRX: stack overflow in srxpfe gives unauthenticated root code execution via a crafted GRE packet

CVSS 9.3CVE-2026-33792Firmware, BMC & network fabriccurated

Impact

A crafted packet received on a configured GRE tunnel overflows a stack buffer in srxpfe, the SRX packet forwarding engine, and the advisory says this allows code execution as root or a denial of service. srxpfe handles production traffic, so an attacker who lands this gets root on the device that enforces every security policy in front of the fleet - policy bypass, traffic interception, and a persistent foothold in the path between tenants and the outside world. No credentials are needed. For an operator this is the worst shape of firewall bug: the attack surface is the data path itself, not a management interface that could be hidden behind a jump host.

Who can reach it

Network, unauthenticated. Anyone who can send packets into a configured GRE tunnel endpoint on the SRX. Requires a GRE tunnel to be configured; GRE source filtering reduces who can reach it.

What to do

Upgrade Junos OS on affected SRX Series devices per Juniper advisory JSA112186; the NVD record does not name fixed releases, so take the version for your train from the bulletin. Where a window is not available immediately, restrict GRE tunnel endpoints to known peer addresses with firewall filters on the loopback/transit interfaces. The upgrade reboots the chassis - drain to the HA peer first, because an SRX restart drops the traffic path it fronts.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-33792 https://supportportal.juniper.net/JSA112186

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.