CVE-2026-28532
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. An attacker with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.
Risk Assessment
This could cause router crashes and network disruption, leading to service unavailability. The attacker must have an established OSPF adjacency, but the consequences are severe for the entire infrastructure.
Recommendation
Update FRRouting to version 10.5.3 or later. Additionally, consider limiting trust in OSPF neighbors and monitoring for malformed packets.
Other vulnerabilities in FRRouting
See all- CVE-2020-12831Low
In FRRouting (FRR) up to version 7.3.1, when using the split-config feature, the init script creates an empty config file with world-readable default permissions, potentially leading to information leakage via frr.in and frrcommon.sh.in tools.
- CVE-2026-37460High
Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) in FRRouting (FRR) from stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) by supplying a crafted BGP UPDATE message.
- CVE-2026-37459High
An integer underflow vulnerability exists in FRRouting (FRR) versions stable/10.0 through stable/10.6. Attackers can cause a Denial of Service (DoS) by sending a crafted BGP UPDATE message.
- CVE-2026-37457High
An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function of FRRouting (FRR) stable/10.0 allows attackers to cause a Denial of Service (DoS) via a crafted FlowSpec component.
- CVE-2023-3748Low
A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an attacker to send specially crafted hello messages, leading to an infinite loop and causing a denial of service.
Original NVD description (English source)
FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS