High priorityDisclosed

Advisory · CVE-2026-102052

Stack overflow in Junos DHCP daemon lets a rogue server response run code as root

A stack-based buffer overflow in the jdhcpd process of Junos OS and Junos OS Evolved lets an adjacent unauthenticated attacker deny service or execute arbitrary code with root privileges via a malformed DHCPv4 server response when the DHCPv4 local-client feature is used. Juniper rates it CVSS 3.1 8.8.

Advisory published October 14, 2026Independent summary
Vendor
Juniper Networks
Product
Junos OS
Identifier / CWE
CVE-2026-102052
CWE-121
Action timing
Immediate
ELI5

Explain it like I’m five

The device asks for an address, and the answer comes back weaponized against the daemon that asked.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Device requests DHCPv4

    A Junos device using the DHCPv4 local-client feature broadcasts for a lease.

  2. 02Rogue response answers

    An adjacent attacker answers with a malformed DHCPv4 server response.

  3. 03jdhcpd overflows

    The stack overflow executes code as root or denies service.

What happened

Juniper disclosed CVE-2026-102052 in its October 2026 security release: a stack-based buffer overflow (CWE-121) in jdhcpd. When the DHCPv4 local-client feature is used, a malformed DHCPv4 server response from an adjacent position can execute arbitrary code with root privileges or deny service.

Juniper’s JSA112187 lists the affected service releases and the October 2026 service release thresholds that carry the fix. Match your exact release to the advisory rather than guessing here.

What to do

  1. Inventory every Junos OS deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Junos OS while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for jdhcpd crashes and DHCPv4 responses with unusual option lengths on client interfaces.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Rogue DHCP is an old classroom attack with a new root shell attached. Patch and keep rogue-server detection on.