CVE-2026-101981

Executive Summary

CVE-2026-101981 is a critical stack-based buffer overflow (CWE-121) in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated, adjacent attacker acting as an LDP peer can trigger the flaw by sending a malformed LDP Label Mapping message, causing rpd to crash or potentially achieving arbitrary code execution. With a CVSS base score of 8.8, this vulnerability poses a severe risk to network infrastructure where LDP is enabled and peer adjacency can be established.

Technical Analysis

The vulnerability resides in the routing protocol daemon (rpd), the Junos component responsible for managing routing protocols including LDP (Label Distribution Protocol). The flaw is classified as CWE-121: Stack-based Buffer Overflow, meaning a fixed-size stack buffer is populated with attacker-controlled data that exceeds its bounds, corrupting adjacent stack memory (including saved instruction pointers or return addresses).

The attack surface is the LDP control plane. LDP peers exchange messages over TCP/646 (the IANA-assigned LDP port) to establish sessions and distribute label bindings. The NVD description explicitly identifies the trigger: a malformed LDP Label Mapping message. Label Mapping messages are used to advertise a label-to-FEC (Forwarding Equivalence Class) binding to a peer. Prior to authentication (or in configurations without LDP authentication or with weak/no MD5 session authentication), an adjacent attacker positioned on the network can establish or inject into an LDP session and deliver this message.

Because the overflow occurs in rpd, a critical long-lived daemon, two outcomes are possible:

1. Denial of service — the corrupted stack leads to a crash of rpd, disrupting routing and label distribution across the device. Junos typically restarts rpd, but repeated crashes cause route flapping and service disruption.
2. Arbitrary code execution — if the overflow is crafted with a controlled overwrite of a return address or function pointer, an attacker may redirect execution. On Junos, rpd runs with elevated privileges within the routing subsystem, so successful RCE yields deep control over the device's routing behavior.

The CVSS vector reflects the preconditions: AV:A (Adjacent — attacker must be reachable on the same Layer 2/Layer 3 adjacency), AC:L (Low attack complexity — no special conditions beyond a crafted message), PR:N (No privileges required), UI:N (No user interaction). The C:H/I:H/A:H triad indicates high confidentiality, integrity, and availability impact, consistent with a daemon that can execute code and control routing state. Scope is unchanged (S:U), meaning impact is contained to the vulnerable component but not across security boundaries in the CVSS model.

No public proof-of-concept, exploit code, or Nuclei template is currently available. No patch evidence exists in any tracked source, so the vulnerability should be treated as unpatched.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class (CWE-121) and the mechanism described in the NVD entry.

Step 1 — Reconnaissance and target identification. The attacker identifies a target running Junos OS or Junos OS Evolved with LDP enabled and an accessible rpd control plane. This can be accomplished by scanning for TCP/646 exposure or by being positioned adjacent to the device (e.g., on a peering link, shared segment, or an adjacent router under attacker control). LDP is commonly enabled in MPLS and service-provider environments, so internet-adjacent or carrier-interconnect ports may be in scope if LDP is configured.

Step 2 — LDP session establishment. The attacker, operating as (or impersonating) an LDP peer, establishes an LDP session to the target's rpd. Because the CVSS vector specifies PR:N and UI:N, no credentials are required; if LDP MD5 authentication is not configured, the session is established transparently. If authentication is configured, the attacker must possess the shared key, which materially raises the bar — a key reason why this vector assumes no authentication.

Step 3 — Triggering the buffer overflow. The attacker transmits a malformed LDP Label Mapping message. The message carries a payload that, due to insufficient bounds checking in rpd's handling of the parsed Label Mapping data, exceeds the capacity of a stack buffer. This is the class-level mechanism: a length or size field within the LDP message is not properly validated against the destination buffer, so attacker-controlled bytes overwrite stack memory.

Step 4 — Payload and execution. For a crash objective, the malformed message simply overwrites the stack and causes rpd to fault. For an RCE objective, the attacker crafts the payload to overwrite a control-flow target (e.g., a return address or function pointer) and redirect execution to a location under their control or to a ROP chain. The specific offsets, gadget availability, and mitigations (ASLR/NX/stack canaries) on the target are not disclosed in the available data and would require independent analysis.

Step 5 — Post-exploitation impact. Successful RCE in rpd yields control of routing/label distribution on the device, enabling route manipulation, traffic redirection, persistent network-level footholds, or lateral movement into the broader network fabric. A crash-only outcome yields denial of service and route instability. There is no evidence of exploitation in the wild, and no threat-actor attribution is available.

Impact Assessment

• Availability (A:H): rpd crash disrupts label distribution and routing; repeated triggering causes instability across the MPLS/LDP domain.
• Integrity (I:H): RCE permits modification of routing state and configuration behavior governed by rpd.
• Confidentiality (C:H): Code execution within a privileged daemon can expose sensitive routing, topology, and potentially credential material accessible to rpd.
• Attack surface: Any Junos/Junos OS Evolved device with LDP enabled and an adjacent peer adjacency. Service providers and large enterprises running MPLS with LDP are at highest risk.
• Blast radius: A single compromised router can advertise malicious labels/routes, affecting downstream and upstream peers — potential for significant network-wide disruption or traffic interception.
• Exploitability: AC:L, PR:N, UI:N make this attractive; AV:A is the main constraint, limiting remote non-adjacent attackers. EPSS has not yet scored this CVE (do not assume a numeric EPSS). Not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: Juniper Junos rpd LDP Label Mapping Malformed Message (CVE-2026-101981)
id: 9b1f4c2e-7a3d-4e21-9c88-1f0a2b6d4e77
status: experimental
description: Detects malformed LDP Label Mapping messages or rpd crashes in Junos logs consistent with CVE-2026-101981.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101981
author: valtersit.com
logsource:
  product: juniper
  service: junos
detection:
  selection_crash:
    process|contains: 'rpd'
    message|contains:
      - 'rpd'
  selection_ldp:
    message|contains|all:
      - 'LDP'
      - 'Label Mapping'
  condition: selection_crash and selection_ldp
falsepositives:
  - Legitimate LDP Label Mapping advertisements during normal label distribution
level: high
tags:
  - attack.t1190
  - cve.2026.101981

YARA Rule

rule CVE_2026_101981_LDP_Label_Mapping_Overflow
{
    meta:
        description = "Detects malformed LDP Label Mapping payloads targeting Juniper Junos rpd stack buffer overflow (CVE-2026-101981)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101981"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ldp_hdr = { 00 01 }          // LDP version 1 (RFC 5036 header prefix)
        $label_mapping = { 04 00 }    // LDP Message Type 0x0400 = Label Mapping
        $overlong = { FF FF FF FF }

    condition:
        $ldp_hdr at 0 and $label_mapping and #overlong > 1
}

Suricata IDS Rule

alert tcp any 646 -> any 646 (msg:"CVE-2026-101981 Juniper Junos rpd Malformed LDP Label Mapping"; flow:to_server,established; content:"|04 00|"; offset:0; depth:16; content:"|FF FF FF FF|"; within:64; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-admin; reference:cve,2026-101981; sid:2026101981; rev:1;)

Elastic Detection

// Detects rpd crashes / restarts correlated with LDP events on Junos devices
// CVE-2026-101981 - stack-based buffer overflow via malformed LDP Label Mapping
sequence by host.name with maxspan=5m
  [ process where process.name == "rpd" and event.action == "restart" ]
  [ network where network.transport == "tcp" and (source.port == 646 or destination.port == 646) ]

Splunk SPL Query

index=network sourcetype=juniper:junos OR sourcetype=junos
| search ("rpd" AND ("crash" OR "core" OR "restart" OR "rpd.*terminated"))
| append
    [ search index=network (sourcetype=pan:traffic OR sourcetype=suricata)
      | search dest_port=646 OR src_port=646
      | stats count by src_ip, dest_ip, dest_port ]
| stats values(message) as messages, count by host, src_ip
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="juniper,junos,">
  <rule id="101981" level="12">
    <decoded_as>juniper-junos</decoded_as>
    <match>rpd</match>
    <regex type="pcre2">rpd.*(crash|core|restart|terminated|signal)</regex>
    <description>CVE-2026-101981: Junos rpd crash/restart - possible malformed LDP Label Mapping exploitation</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_101981,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Enable LDP MD5 session authentication between all LDP peers to prevent unauthenticated adjacent peers from injecting crafted Label Mapping messages. This directly addresses the PR:N precondition (CVSS AV:A/PR:N).
   • Restrict control-plane access to TCP/646 with ACLs/firewall filters so only known, trusted peers can reach rpd's LDP listener.
   • Where LDP is not required, disable it (e.g., via protocol configuration) to remove the attack surface entirely.
   • Segment and harden the adjacency plane so unauthorized Layer 2/L3 access to LDP sessions is not possible.
   • Monitor rpd for unexpected crashes/restarts; enable core dumps for forensic analysis.

2. Patch/upgrade steps:

   • No patch is available as of this report (no vendor fix, no OSV package data, no version ranges disclosed). Track Juniper's security advisories for the CVE and apply the vendor-released fixed Junos OS / Junos OS Evolved versions as soon as they are published.
   • Do not assume any current release is fixed without confirming against an official Juniper advisory for CVE-2026-101981.

3. Long-term hardening:

   • Enforce LDP authentication and control-plane policing across all MPLS/LDP deployments.
   • Maintain rigorous egress/ingress filtering at peering boundaries to limit which systems can establish LDP adjacencies.
   • Adopt a vulnerability management cadence that tracks Juniper advisories and network-control-plane CVEs (CWE-121 class) proactively.
   • Apply defense-in-depth on Junos (secure boot, configuration rollback, logging to remote syslog) to improve detection and recovery.

References

• NVD — CVE-2026-101981: https://nvd.nist.gov/vuln/detail/CVE-2026-101981
• CWE-121: Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
• RFC 5036 — LDP Specification (Label Mapping message definition): https://www.rfc-editor.org/rfc/rfc5036
• Juniper Networks Security Advisories: https://supportportal.juniper.net/s/global-search/security-advisories
• FIRST EPSS (not yet scored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-101981 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat-actor campaigns or exploit-in-the-wild evidence have been identified for CVE-2026-101981 at the time of writing.