A critical heap-based buffer overflow in sdxd, the service-deployment daemon in Juniper Networks Junos OS and Junos OS Evolved, could let a remote attacker run code as root or cause a denial of service. The attacker does not need to authenticate to the device, but must be able to control or intercept the device's configured SDX/SRC server connection.
What Is It
CVE-2026-102175 is a heap-based buffer overflow (CWE-122) in sdxd, the service-deployment daemon in Junos OS and Junos OS Evolved. Juniper SIRT published the record on 2026-10-14. To exploit it, an attacker has to be able to control or intercept the device's configured SDX/SRC server connection. From that position, they can send a crafted frame over the service-deployment TCP connection and either execute code as root or cause a denial of service.
Why It Matters
Juniper rates the flaw CVSS 3.1 9.8 (CRITICAL) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVSS 4.0 score is 9.3 (CRITICAL). The CVSS scoring treats the attack as network-based, with no privileges or user interaction required, and the CVSS 4.0 data marks it as automatable. In practice, the attacker first has to control or intercept the SDX/SRC server connection, which limits who can reach the vulnerable code path. If exploitation succeeds, it could give root-level code execution on network infrastructure.
As of publication, this CVE does not appear in the CISA Known Exploited Vulnerabilities Catalog, so active exploitation is not confirmed.
What's Vulnerable
Junos OS: - All versions before 23.2R2-S7.7 - 23.4 before 23.4R2-S8.13 - 24.2 before 24.2R2-S5.5 - 24.4 before 24.4R2-S5 - 25.2 before 25.2R2-S2 - 25.4 before 25.4R1-S3 - 26.2 before 26.2R1-S2
Junos OS Evolved: - All versions before 23.2R2-S7.7-EVO - 23.4 before 23.4R2-S8.11-EVO - 24.2 before 24.2R2-S5.6-EVO - 24.4 before 24.4R2-S5-EVO - 25.2 before 25.2R2-S2-EVO - 25.4 before 25.4R1-S3-EVO - 26.2 before 26.2R1-S2-EVO - 23.4X100 (listed as affected, with no fixed version given) - 25.2X100 before 25.2X100-D35-EVO - 25.4X300 before 25.4X300-D40-EVO
The flaw is in the sdxd service-deployment daemon, which talks to a configured SDX/SRC server.
Patch Status
The affected version ranges imply that each listed branch has a fixed release, the "before" version shown above. The one exception is Junos OS Evolved 23.4X100, which has no fixed version in the supplied data. Juniper's advisory JSA112187 is the authoritative source for fixed releases and any workarounds. Administrators should upgrade affected devices to a fixed release on their branch. Since the CVE is not in the KEV catalog, no CISA required action or due date applies at this time. NVD status is "Received" and the record has not been analyzed yet.