CVE-2026-57025
Juniper Junos Os Evolved ≤ 23.2
Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:XSummary
CVE-2026-57025 is a medium-severity Return of Pointer Value Outside of Expected Range (CWE-466) vulnerability in Juniper Junos Os Evolved. Its CVSS base score is 6.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 0.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-6 (Least Privilege) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
EU & UK References
No EU or UK CSIRT advisories indexed for this CVE.
Vulnerability Data
A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privilged attacker to cause a Denial-of-Service (DoS). On EX Series, QFX Series and MX…
more
Series a low-privileged attacker issuing a specific 'show l2-learning' or 'show ethernet-switching' command will cause an l2ald crash which will lead to a temporary service impact for all layer 2 services until the process has automatically restarted. This issue affects EX Series, QFX Series, MX Series: Junos OS: * all versions before 23.2R2-S7, * 23.4 versions before 23.4R2-S7, * 24.2 versions before 24.2R2, * 24.4 versions before 24.4R1-S2. Junos OS Evolved: * all versions before 23.2R2-S7-EVO, * 23.4 versions before 23.4R2-S8-EVO, * 24.2 versions before 24.2R2-EVO, * 24.4 versions before 24.4R1-S3-EVO.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows a low-privileged local attacker to trigger a crash in the l2ald process via a crafted 'show l2-learning' command, resulting in temporary DoS for Layer 2 services. This directly maps to T1499.004 (Endpoint Denial of Service: Application or System Exploitation) as the command input is abused to exhaust or crash a critical system process.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Least privilege directly limits the attack surface by ensuring only authorized users can execute the 'show l2-learning' command that triggers the l2ald crash.
Flaw remediation requires timely patching of the fileio library vulnerability in Junos OS/EVO to eliminate the out-of-range pointer return that causes the DoS.
Configuration settings can restrict or disable the vulnerable 'show l2-learning' command for non-administrative roles until patches are applied.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices enforce bounds checking, static analysis, and pointer validation that directly prevent out-of-range pointer returns.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect out-of-range pointer returns through static analysis and fuzzing.
Secure SDLC practices can include pointer-range validation and bounds checking to prevent out-of-range returns.
Application security requirements can mandate pointer safety and range validation to avoid returning invalid addresses.
Secure architecture principles can enforce memory-safety patterns that reduce the likelihood of out-of-range pointer returns.
Secure coding standards directly address pointer validation and bounds checking, mitigating this specific weakness.