An Out-of-bounds Write vulnerability in the connectivity fault management (CFM) daemon of Juniper Networks Junos OS on MX Series with MPC-BUILTIN, MPC1 through MPC9 line cards allows an unauthenticated adjacent attacker to send a malformed packet to the device, leading to an FPC crash and restart, resulting in a Denial of Service (DoS).

Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

This issue affects Juniper Networks:
Junos OS:

• All versions before 22.2R3-S1,
• from 22.4 before 22.4R2.

This feature is not enabled by default.

Required configuration for exposure: 

The following minimal configuration is necessary to be present to be potentially exposed to this issue:

  [protocols oam ethernet connectivity-fault-management enhanced-cfm-mode]

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was seen during production usage.

The following software releases have been updated to resolve these issues:
Junos OS: 22.2R3-S1, 22.4R2, 23.2R1, and all subsequent releases.

This issue is being tracked as 1726141 which is visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

There are no known workarounds for this issue.

2025-07-09: Initial Publication

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• https://www.cve.org/CVERecord?id=CVE-2025-52952