CVE-2026-102052
8.8HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-121
Impact
Adjacent unauthenticated attackers can crash the jdhcpd process or execute arbitrary code with root privileges. They need network adjacency to send malformed DHCPv4 server responses to devices running the DHCPv4 local-client feature.
Root cause
A stack-based buffer overflow in the jdhcpd daemon triggers when parsing malformed DHCPv4 server responses.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to the fixed Junos OS / Junos OS Evolved release specified in advisory JSA112187. As an interim workaround, disable the DHCPv4 local-client feature where possible.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks Junos OS and Junos OS Evolved platforms allows an adjacent unauthenticated attacker to cause denial of service or execute arbitrary code with root privileges via a malformed DHCPv4 server response when the DHCPv4 local-client feature is used.