CVE-2026-57025: A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privilged attacker to

mediumCVSS 5.5CVE-2026-57025

A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privilged attacker to cause a Denial-of-Service (DoS). On EX Series, QFX Series and MX Series a low-privileged attacker issuing a specific 'show l2-learning' command will cause an l2ald crash which will lead to a temporary service impact for all layer 2 services until the process has automatically restarted. This issue affects EX Series, QFX Series, MX Series: Junos OS: - all versions before 23.2R2-S7, - 23.4 versions before 23.4R2-S7, - 24.2 versions before 24.2R2, - 24.4 versions before 24.4R1-S2. Junos OS Evolved: - all versions before 23.2R2-S7-EVO, - 23.4 versions before 23.4R2-S8-EVO, - 24.2 versions before 24.2R2-EVO, - 24.4 versions before 24.4R1-S3-EVO.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: medium — CVSS 5.5
Published: 2026-07-09
Last updated: 2026-07-10
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-57025

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-570250.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-57025	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[NEW] [high] Juniper JUNOS and JUNOS Evolved: Multiple vulnerabilitiescert-bund
unknownJuniper Junos OS Multiple Vulnerabilitieshkcert
unknownMultiple vulnerabilities in Juniper Networks products (July 09, 2026)cert-fr-avis

Recent advisories for A Return of

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-59155: Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool…nvd · 2026-07-10
unknownCVE-2026-55881: OpenReplay is a self-hosted session replay suite. From 1.22.0 before 1.27.0, getFirstMob retur…nvd · 2026-07-10
highCVE-2026-56667: ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC…nvd · 2026-07-10
mediumCVE-2026-59853: SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storag…nvd · 2026-07-09
mediumCVE-2026-61344: The Superior Court of California Hearing Reminder Service at https://www.hrs.courts.ca.gov exp…nvd · 2026-07-09
mediumCVE-2026-59222: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7…nvd · 2026-07-09