CVE-2026-28532: Integer Overflow in FRRouting
Platform
linux
Component
frr
Fixed in
10.5.4
CVE-2026-28532 describes an integer overflow vulnerability discovered in FRRouting, a routing protocol daemon. This flaw allows attackers with an established OSPF adjacency to send malicious packets, potentially leading to denial of service and system crashes. The vulnerability affects FRRouting versions from 0.0.0 up to and including 10.5.3, and a patch is available in version 10.5.4.
Impact and Attack Scenarios
An attacker exploiting this vulnerability can craft a malicious Type 10 or Type 11 Opaque LSA within an OSPF LS Update packet. Due to an integer overflow in the TLV parser, the loop termination condition fails while pointer advancement continues unchecked. This results in out-of-bounds memory reads, which can lead to a denial of service by crashing the affected FRRouting router. The impact extends beyond a single router; the vulnerability can affect all routers within the OSPF area or autonomous system, potentially disrupting routing and network connectivity. This vulnerability shares similarities with other routing protocol vulnerabilities that exploit malformed packet processing, highlighting the importance of robust input validation.
Exploitation Context
CVE-2026-28532 was published on 2026-04-30. Its severity is rated as MEDIUM (CVSS 6.5). Currently, there are no publicly known active campaigns exploiting this vulnerability. No KEV or EPSS score is available at this time. Monitor security advisories and threat intelligence feeds for updates on exploitation activity.
Threat Intelligence
Exploit Status
EPSS
0.02% (5% percentile)
CVSS Vector
What do these metrics mean?
- Attack Vector
- Adjacent — requires network proximity: same LAN, Bluetooth, or local wireless segment. Not internet-exposed.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- None — unauthenticated. No login or credentials needed to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- None — no confidentiality impact. Attacker cannot read protected data.
- Integrity
- None — no integrity impact. Attacker cannot modify data.
- Availability
- High — complete crash or resource exhaustion. Full denial of service.
Affected Software
Weakness Classification (CWE)
Timeline
- Published
- Modified
- EPSS updated
Mitigation and Workarounds
The primary mitigation for CVE-2026-28532 is to upgrade FRRouting to version 10.5.4 or later, which contains the necessary fix. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as rate-limiting OSPF LS Update packets or filtering packets based on known malicious patterns. While not a complete solution, these measures can reduce the attack surface. Monitor network traffic for unusual OSPF LS Update activity. After upgrading, confirm the fix by sending a test LS Update packet with a large TLV size and verifying that the router does not crash or exhibit unexpected behavior.
How to fix
Actualice a la versión 10.5.4 o posterior de FRRouting para mitigar la vulnerabilidad de desbordamiento de enteros. Esta actualización corrige el problema truncando correctamente los valores uint32_t antes de usarlos en los cálculos, evitando así la condición de terminación del bucle fallida y las lecturas de memoria fuera de límites.
Frequently asked questions
What is CVE-2026-28532 — Integer Overflow in FRRouting?
CVE-2026-28532 is a medium severity vulnerability in FRRouting where crafted OSPF packets can cause out-of-bounds memory reads and crashes. It affects versions 0.0.0–10.5.3.
Am I affected by CVE-2026-28532 in FRRouting?
If you are running FRRouting versions 0.0.0 through 10.5.3, you are potentially affected. Check your FRRouting version immediately using frr-version.
How do I fix CVE-2026-28532 in FRRouting?
Upgrade FRRouting to version 10.5.4 or later to resolve the integer overflow vulnerability. If immediate upgrade is not possible, consider temporary workarounds like rate-limiting OSPF updates.
Is CVE-2026-28532 being actively exploited?
Currently, there are no publicly known active campaigns exploiting CVE-2026-28532, but continuous monitoring is recommended.
Where can I find the official FRRouting advisory for CVE-2026-28532?
Refer to the FRRouting security advisories on their official website or mailing lists for the latest information and updates regarding CVE-2026-28532.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...