Junos OS on SRX: stack overflow in srxpfe gives root code execution from the HA fabric link

CVSS 8.7CVE-2026-33798Firmware, BMC & network fabriccurated

Impact

srxpfe overflows a stack buffer while processing high-availability fabric traffic, letting an L2-adjacent attacker execute arbitrary code as root with no authentication. The exposed surface is the HA fabric link between chassis in a cluster - a link operators treat as trusted and often leave on an unfiltered VLAN or a shared top-of-rack switch. Anyone who can reach that broadcast domain, including a compromised neighbouring host on the same L2 segment, gets root on both firewall nodes, which defeats the redundancy entirely: the HA pair fails together rather than one surviving. This affects both Junos OS and Junos OS Evolved, and is a different path from the GRE-tunnel overflow in the same daemon (CVE-2026-33792).

Who can reach it

L2-adjacent, unauthenticated (AV:A). An attacker must be able to put frames on the high-availability fabric segment between clustered SRX nodes. Standalone SRX devices with no HA cluster do not have this path.

What to do

Upgrade Junos OS and Junos OS Evolved per Juniper advisory JSA112186; the NVD record does not name fixed releases. Independently, the HA fabric link should be on a dedicated, isolated L2 segment or back-to-back cabling with nothing else on it - that is good practice regardless and is what limits reachability here. Upgrading a cluster means rebooting each node in turn, so plan a rolling window; both nodes must end on the fixed release.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-33798 https://supportportal.juniper.net/JSA112186

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.