PT-2026-36172 · Frrouting · Frrouting

Vulncheck · Published 2026-04-30 · Updated 2026-05-01 · CVE-2026-28532

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FRRouting versions prior to 10.5.3

Description An integer overflow exists in seven OSPF Traffic Engineering and Segment Routing TLV parser functions. A uint16 t accumulator variable truncates uint32 t values returned by the TLV SIZE() macro, which causes the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet containing a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads, resulting in a crash of all affected routers within the OSPF area or autonomous system.

Recommendations Update to version 10.5.3.

Fix

Out of bounds Read

Integer Overflow

Weakness Enumeration

CWE-125

CWE-190

Related Identifiers

CVE-2026-28532

Affected Products

Frrouting

References · 8

• https://github.com/FRRouting/frr/commit/f098decf02987fbf1c891766c1516ac832adadfd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-28532 · Security Note
• https://github.com/FRRouting/frr/pull/21002 · Note
• https://github.com/FRRouting/frr/releases/tag/frr-10.5.3 · Note
• https://twitter.com/infoflowcloud/status/2049957377277911334 · Twitter Post
• https://twitter.com/CVEnew/status/2049955997457031445 · Twitter Post
• https://vulncheck.com/advisories/frrouting-integer-overflow-in-ospf-tlv-parser-functions · Note
• https://twitter.com/VulmonFeeds/status/2050059261254705627 · Twitter Post