CVE-2026-28532 Details
Description
FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.
An integer overflow vulnerability has been identified in FRRouting versions prior to 10.5.3. This vulnerability exists in seven OSPF Traffic Engineering and Segment Routing TLV parser functions. The issue arises because a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro. This truncation causes the loop termination condition to fail, allowing pointer advancement to continue unchecked. Exploitation of this vulnerability can lead to out-of-bounds memory reads, causing all affected routers in the OSPF area or autonomous system to crash. The vulnerability can be triggered by attackers with an established OSPF adjacency who send a crafted LS Update packet containing a malicious Type 10 or Type 11 Opaque LSA.
Users can upgrade to FRRouting version 10.5.3 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| frrouting frrouting | < 10.5.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | Initial Analysis | [email protected] |
| Apr 30, 2026 | New CVE Received | [email protected] |