Pre-auth RCE in Junos srxpfe on SRX exposed via GRE tunnels

Juniper published advisory JSA112186 for CVE-2026-33792, a stack-based buffer overflow in srxpfe, the Junos OS forwarding process on SRX Series. A crafted packet from a configured GRE tunnel, with no authentication or user interaction, allows root code execution or denial of service; CVSS 9.8. Fixes ship in releases from 23.2R2-S7.7 through 26.4R1.

• CVE-2026-33792: CWE-121 in srxpfe, rated 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0
• Trigger is a crafted packet on a configured GRE tunnel, no auth or user interaction
• Impact is root code execution or DoS; no workaround is published
• Fixed builds: 23.2R2-S7.7, 24.4R2-S5, 25.4R2, 26.2R2, 26.4R1 and later