CVE-2026-102052

Executive Summary

CVE-2026-102052 is a stack-based buffer overflow (CWE-121) in the jdhcpd process of Juniper Networks Junos OS and Junos OS Evolved. An adjacent, unauthenticated attacker can trigger the flaw by sending a malformed DHCPv4 server response when the DHCPv4 local-client feature is enabled, resulting in denial of service or arbitrary code execution with root privileges. With a CVSS base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability is rated high severity due to its adjacency-reachable attack vector, no required privileges, and full confidentiality, integrity, and availability impact.

Technical Analysis

The vulnerability resides in jdhcpd, the Juniper DHCP daemon responsible for DHCP client and server operations on Junos OS and Junos OS Evolved platforms. The weakness is classified as CWE-121, a stack-based buffer overflow, which occurs when a program writes more data to a fixed-length buffer allocated on the call stack than the buffer can hold. In this case, the overflow is triggered by processing a malformed DHCPv4 server response.

The root cause class is improper bounds checking during parsing or copying of attacker-controlled data from a DHCPv4 server response into a stack-allocated buffer. When the DHCPv4 local-client feature is in use, the device acts as a DHCP client and processes responses from a DHCPv4 server. Because the attacker controls or can spoof the DHCPv4 server response, they control the malformed input that reaches the vulnerable parsing logic in jdhcpd.

The overflow can corrupt adjacent stack memory, including saved return addresses and local variables. Successful corruption of control-flow data can redirect execution, enabling arbitrary code execution with root privileges because jdhcpd runs with elevated privileges. When control-flow corruption is not cleanly exploitable, the most common outcome is a crash of the jdhcpd process, producing a denial-of-service condition on the affected device.

The attack vector is adjacent (AV:A), meaning the attacker must be positioned on the same Layer 2/Layer 3 broadcast domain or otherwise able to deliver IP traffic to the target as an adjacent network peer. No authentication (PR:N) and no user interaction (UI:N) are required. The vulnerable code path is only reachable when the DHCPv4 local-client feature is configured.

No specific function names, offsets, buffer sizes, or code paths are disclosed in the available NVD description. The precise memory-safety failure point within jdhcpd is not enumerated in the provided data. The description specifies the vulnerable process (jdhcpd), the platform family (Junos OS and Junos OS Evolved), the trigger (malformed DHCPv4 server response), and the precondition (DHCPv4 local-client feature in use).

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2026-102052. The attack chain below is inferred from the vulnerability class and the documented trigger conditions.

1. Reconnaissance / target identification. The attacker identifies candidate Juniper Junos OS / Junos OS Evolved devices on the adjacent network segment. Devices are of interest if the DHCPv4 local-client feature is enabled, since that feature makes jdhcpd process DHCPv4 server responses. Service and device fingerprinting can be performed via normal network discovery against the adjacent segment.

2. Triggering the flaw. An adjacent attacker who can act as, spoof, or intercept a DHCPv4 server sends a malformed DHCPv4 server response to the target device. The precondition is that the target is using the DHCPv4 local-client feature and therefore accepts and parses server responses. The malformed response causes jdhcpd to write beyond the bounds of a stack-allocated buffer during processing — a stack-based buffer overflow (CWE-121).

3. Payload/execution method. Because this is a memory-corruption flaw, the attacker crafts the malformed DHCPv4 response so that the overflow corrupts stack memory. At the vulnerability-class level, the attacker aims to overwrite control data such as a return address to hijack execution flow. If a working exploit is developed, arbitrary code would execute in the context of jdhcpd, which runs with root privileges. If the corruption is not reliably controllable, the device's DHCP process crashes.

4. Post-exploitation impact. Two outcomes are possible per the NVD description: (a) denial of service — jdhcpd crashes, disrupting DHCP-dependent functionality on the device; or (b) arbitrary code execution with root privileges — full compromise of the device at the highest privilege level. Root-level code execution on a Junos device is a severe outcome with broad downstream risk to the network fabric the device controls.

Impact Assessment

The CVSS 3.1 base score is 8.8 (High). The subscores are:

• Attack Vector (AV:A — Adjacent): The attacker must be on the same logical network neighborhood as the target, not remotely routable over the internet by default.
• Attack Complexity (AC:L — Low): No special conditions beyond the presence of the DHCPv4 local-client feature and the ability to deliver a DHCPv4 server response; no pre-existing race or configuration condition is noted.
• Privileges Required (PR:N — None): The attacker needs no credentials.
• User Interaction (UI:N — None): No user action is needed to trigger the flaw.
• Scope (S:U — Unchanged): The vulnerable component and impacted component are the same.
• Confidentiality (C:H), Integrity (I:H), Availability (A:H): All three are rated High. The High availability impact reflects the denial-of-service outcome; High confidentiality and integrity impacts reflect the potential for root-level arbitrary code execution on the device.

Affected systems are Juniper Networks Junos OS and Junos OS Evolved platforms running the DHCPv4 local-client feature. Blast radius considerations: while the attack vector is adjacent, a compromised or crashed edge/aggregation device can affect large downstream segments — routing, switching, and dependent services. Root-level code execution elevates the severity because the attacker could alter device configuration, disrupt routing, or use the device as a foothold. Business impact includes potential network outage, loss of DHCP service, and compromise of the network infrastructure plane if code execution succeeds.

Detection Guidance

Sigma Rule

title: Potentially Malicious DHCPv4 Server Response Targeting Juniper jdhcpd
id: 3f6b9c2a-7c1e-4d8a-9b2f-5a1c0e4d7f11
status: experimental
description: Detects DHCPv4 server responses correlated with anomalous jdhcpd behavior for CVE-2026-102052
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102052
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  product: juniper
  service: junos
detection:
  selection_process:
    process_name: 'jdhcpd'
  selection_fault:
    EventID:
      - 'CRASH'
      - 'CORE_DUMP'
      - 'SIGSEGV'
      - 'ABORT'
  condition: selection_process and selection_fault
falsepositives:
  - Legitimate jdhcpd restarts or managed reboots
  - Debug/reload events during maintenance windows
level: high
tags:
  - attack.t1190
  - cve.2026.102052

YARA Rule

rule CVE_2026_102052_Juniper_jdhcpd_StackOverflow
{
    meta:
        description = "Detects indicators of DHCPv4-driven stack buffer overflow exploitation against jdhcpd"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102052"
        cve = "CVE-2026-102052"
        date = "2026-01-01"

    strings:
        $proc = "jdhcpd" ascii wide
        $dhcp = "DHCPv4" ascii wide
        $xid  = { 63 82 53 63 }  // DHCP magic cookie (0x63825363)

    condition:
        uint16(0) == 0x5A4D or true and ($proc or $dhcp)
}

Suricata IDS Rule

alert udp any 67 -> any 68 (msg:"CVE-2026-102052 Juniper jdhcpd Potential DHCPv4 Malformed Server Response"; flow:stateless; content:"|63 82 53 63|"; offset:236; depth:4; byte_test:1,>,0,240; threshold:type both, track by_src, count 5, seconds 10; reference:cve,2026-102052; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102052; classtype:attempted-admin; sid:2026102052; rev:1;)

Elastic Detection

process where process.name == "jdhcpd" and
  (event.action in ("crash", "core_dump", "segfault") or
   message like~ "*signal 11*" or message like~ "*SIGSEGV*")

Splunk SPL Query

index=juniper sourcetype=juniper:junos (process="jdhcpd" OR "jdhcpd") 
  ("SIGSEGV" OR "core dump" OR "crash" OR "abort")
| stats count min(_time) as first_seen max(_time) as last_seen by host, process, message
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="juniper,junos,jdhcpd,">
  <rule id="100052" level="12">
    <decoded_as>juniper</decoded_as>
    <match>jdhcpd</match>
    <regex>CRASH|SIGSEGV|SIGABRT|core dump|segmentation fault</regex>
    <description>CVE-2026-102052: Potential jdhcpd stack buffer overflow / crash on Junos (DHCPv4 server response)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_102052,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No affected version range, no vendor fix, and no workaround data were provided in the available intelligence. Treat the following as defensive guidance based on the vulnerability class and documented attack preconditions.

1. Immediate mitigations.

   • Determine whether the DHCPv4 local-client feature is enabled on affected Junos OS / Junos OS Evolved devices. The vulnerability is only reachable when this feature is in use.
   • If the feature is not required, disable it to remove the vulnerable code path.
   • Where the feature is required, restrict the adjacent attack surface: enforce Layer 2 segmentation, port security, DHCP snooping, and DHCP server-response validation so that only trusted DHCPv4 servers can deliver responses to client devices.
   • Apply network access controls to prevent unauthorized adjacent hosts from transmitting DHCPv4 server responses (UDP/67) toward client interfaces.
   • Monitor jdhcpd for crashes, core dumps, and unexpected restarts as an indicator of exploitation attempts.

2. Patch/upgrade steps.

   • No patch evidence is currently available from tracked sources. Monitor Juniper Networks security advisories (SIRT) and the NVD entry for CVE-2026-102052 for an official fixed release.
   • Once a vendor fix is published, apply the recommended Junos OS / Junos OS Evolved upgrade on all affected platforms, prioritizing devices that run the DHCPv4 local-client feature.
   • Verify the fix by confirming the running software version post-upgrade and re-testing the DHCPv4 local-client function in a lab before production rollout.

3. Long-term hardening.

   • Minimize enabled services on network infrastructure; disable features such as DHCPv4 local-client unless operationally required.
   • Adopt strict Layer 2 hygiene (DHCP snooping, dynamic ARP inspection, port security, 802.1X) to constrain adjacent attackers.
   • Maintain a routine patch cadence tied to vendor security advisories and track CVEs affecting network operating systems in a vulnerability management program.
   • Enable and centrally collect device logs and crash telemetry to detect exploitation attempts early.

References

1. NVD — CVE-2026-102052: https://nvd.nist.gov/vuln/detail/CVE-2026-102052
2. MITRE CWE-121 — Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. FIRST EPSS (CVE-2026-102052 not yet scored): https://www.first.org/epss/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-102052 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, or KEV listing was identified. No threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE in the provided data.