CVE-2026-28532— FRRouting < 10.5.3 Integer Overflow in OSPF TLV Parser Functions

FRRouting < 10.5.3 Integer Overflow in OSPF TLV Parser Functions

FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

整数溢出或超界折返

FRRouting 缓冲区错误漏洞

FRRouting是FRRouting开源的一种在类 Unix 平台上运行的网络路由软件套件。 FRRouting 10.5.3之前版本存在缓冲区错误漏洞，该漏洞源于七个OSPF流量工程和段路由TLV解析器函数中存在整数溢出，uint16_t累加器变量截断TLV_SIZE()宏返回的uint32_t值，导致循环终止条件失败而指针推进未检查，攻击者可以通过建立的OSPF邻接关系发送特制的LS更新数据包触发越界内存读取并崩溃OSPF区域或自治系统中的所有受影响路由器。

N/A

N/A