CVE-2026-28532

FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/FRRouting/frr/commit/f098decf02987fbf1c891766c1516ac832adadfd	Patch
https://github.com/FRRouting/frr/pull/21002	Issue Tracking Patch
https://github.com/FRRouting/frr/releases/tag/frr-10.5.3	Release Notes
https://www.vulncheck.com/advisories/frrouting-integer-overflow-in-ospf-tlv-parser-functions	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) FRRouting anterior a la versión 10.5.3 contiene una vulnerabilidad de desbordamiento de entero en siete funciones de análisis TLV de Ingeniería de Tráfico OSPF y Enrutamiento por Segmentos, donde una variable acumuladora uint16_t trunca valores uint32_t devueltos por la macro TLV_SIZE(), lo que provoca que la condición de terminación del bucle falle mientras el avance del puntero continúa sin control. Atacantes con una adyacencia OSPF establecida pueden enviar un paquete LS Update manipulado con un LSA opaco de Tipo 10 o Tipo 11 malicioso para desencadenar lecturas de memoria fuera de límites y provocar la caída de todos los routers afectados en el área OSPF o sistema autónomo.

Information

Published : 2026-04-30 21:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-28532

Mitre link : CVE-2026-28532

CVE.ORG link : CVE-2026-28532

JSON object : View

Products Affected

frrouting

frrouting

CWE

CWE-125

Out-of-bounds Read

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-28532", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28532", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-01T16:36:13.274707Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "FRRouting", "product": "frr", "versions": [{"status": "affected", "version": "0", "lessThan": "10.5.3", "versionType": "semver"}], "defaultStatus": "affected"}]}], "published": "2026-04-30T21:16:31.250", "references": [{"url": "https://github.com/FRRouting/frr/commit/f098decf02987fbf1c891766c1516ac832adadfd", "tags": ["Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/FRRouting/frr/pull/21002", "tags": ["Issue Tracking", "Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/FRRouting/frr/releases/tag/frr-10.5.3", "tags": ["Release Notes"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/frrouting-integer-overflow-in-ospf-tlv-parser-functions", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system."}, {"lang": "es", "value": "FRRouting anterior a la versi\u00f3n 10.5.3 contiene una vulnerabilidad de desbordamiento de entero en siete funciones de an\u00e1lisis TLV de Ingenier\u00eda de Tr\u00e1fico OSPF y Enrutamiento por Segmentos, donde una variable acumuladora uint16_t trunca valores uint32_t devueltos por la macro TLV_SIZE(), lo que provoca que la condici\u00f3n de terminaci\u00f3n del bucle falle mientras el avance del puntero contin\u00faa sin control. Atacantes con una adyacencia OSPF establecida pueden enviar un paquete LS Update manipulado con un LSA opaco de Tipo 10 o Tipo 11 malicioso para desencadenar lecturas de memoria fuera de l\u00edmites y provocar la ca\u00edda de todos los routers afectados en el \u00e1rea OSPF o sistema aut\u00f3nomo."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0672500D-B272-4026-85C8-3F3B2C18ED00", "versionEndExcluding": "10.5.3"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}