Log in Start free

Vulnerability · Published Apr 30, 2026 · Assigned by VulnCheck

CVE-2026-28532FRRouting < 10.5.3 Integer Overflow in OSPF TLV Parser Functions

Medium 6.5

In plain English

A medium-severity integer overflow in frr from FRRouting. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 86.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12frr8.4.4-1.1~deb12u2DEBIAN-CVE-2026-28532
Debian:13frr10.3-3+deb13u1DEBIAN-CVE-2026-28532
Debian:14frr10.5.3-1DEBIAN-CVE-2026-28532
Ubuntu:22.04:LTSfrr8.1-1ubuntu1.16UBUNTU-CVE-2026-28532
Ubuntu:24.04:LTSfrr8.4.4-1.1ubuntu6.7UBUNTU-CVE-2026-28532
Ubuntu:25.10frr10.4.1-3ubuntu1.4UBUNTU-CVE-2026-28532
Ubuntu:26.04:LTSfrr10.5.1-1ubuntu4.1UBUNTU-CVE-2026-28532

Affected products (as reported)

VendorProductVersions
FRRouting frr 0 – before 10.5.3

Weakness: CWE-190, CWE-125 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References