PT-2026-36172 · Frrouting+2 · Frrouting+2

Vulncheck · Published 2026-04-30 · Updated 2026-06-03 · CVE-2026-28532

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FRRouting versions prior to 10.5.3

Description An integer overflow exists in seven OSPF Traffic Engineering and Segment Routing TLV parser functions. A uint16 t accumulator variable truncates uint32 t values returned by the TLV SIZE() macro, which causes the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet containing a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads, resulting in a crash of all affected routers within the OSPF area or autonomous system.

Recommendations Update to version 10.5.3.

Fix

Integer Overflow

Out of bounds Read

Weakness Enumeration

CWE-190

CWE-125

Related Identifiers

CVE-2026-28532

OPENSUSE-SU-2026:10721-1

SUSE-SU-2026:22026-1

USN-8376-1

Affected Products

Frrouting

Linuxmint

Ubuntu

References · 30

• https://github.com/FRRouting/frr/pull/21002 · Patch
• https://github.com/FRRouting/frr/commit/f098decf02987fbf1c891766c1516ac832adadfd · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-28532 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-37458 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-28532 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8376-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8376-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-37457 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-37459 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-28532 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:22026-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28532 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10721-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-28532 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-28532 · Vendor Advisory