---
id: "CVE-2026-121289"
page: "https://infrastack.ai/live/CVE-2026-121289"
kind: "vulnerability"
aliases: ["CVE-2026-121289"]
title: "Arista EOS: crafted packet crashes the BGP agent (stack buffer overflow), code execution possible"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "EOS", "fixed": ["4.37.0F", "4.36.3M", "4.35.7M", "4.34.9M", "4.33.11M"], "affected": "<= 4.36.2F", "ecosystem": "vendor"}]
ecosystems: []
tags: ["arista-eos", "bgp", "infrastructure", "network-infrastructure", "self-hosted"]
not_affected_if: ["no-bgp-configured", "ribd-routing-model"]
published_at: "2026-11-10T20:18:54+00:00"
first_seen_at: "2026-11-10T20:46:03+00:00"
updated_at: "2026-11-10T20:51:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121289", "first_seen_at": "2026-11-10T20:46:03+00:00"}, {"source": "analyst", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25030-security-advisory-0208", "first_seen_at": "2026-11-10T20:51:02+00:00", "cites": ["https://www.arista.com/en/support/advisories-notices/security-advisory/25030-security-advisory-0208"]}]
exploit_sources: []
---

# Arista EOS: crafted packet crashes the BGP agent (stack buffer overflow), code execution possible

Link for people: https://infrastack.ai/live/CVE-2026-121289 (this .md is for agents)

Arista Security Advisory 0208: on EOS with BGP configured and the multi-agent routing protocol model in use, a specially crafted packet can crash the BGP agent (stack-based buffer overflow, CWE-121), dropping all BGP sessions. Arista says a sophisticated attacker may also achieve arbitrary code execution; that is stated as possible, not demonstrated. Reported by Joshua Foote of JP Morgan Chase; Arista is not aware of malicious exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EOS affected <= 4.36.2F fixed 4.37.0F, 4.36.3M, 4.35.7M, 4.34.9M, 4.33.11M

## How to check

Exposed only if BOTH hold: BGP is running (`show ip bgp summary` does not say '% BGP is not running') AND `show running-config all | inc service routing protocols` returns 'service routing protocols model multi-agent' (model ribd = not exposed). Then compare `show version` with the affected list. IoC: `grep "PROCESS_TERMINATED: 'Bgp'" /var/log/eos` from bash, or the ProcMgr 'Bgp ... status=-11 has terminated' line in show logging.

## Fix

Upgrade to 4.37.0F or later, 4.36.3M, 4.35.7M, 4.34.9M or 4.33.11M (or later in the same train). No hotfix. Workaround if you do not use the Tunnel Encapsulation Attribute: 'neighbor default received attribute discard 23'. Mitigation: TCP-AO authentication on BGP peers.

## Timeline

- 2026-11-10T20:46:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121289
- 2026-11-10T20:51:02+00:00 analyst https://www.arista.com/en/support/advisories-notices/security-advisory/25030-security-advisory-0208 — Read Arista SA 0208 (primary). Stack-based buffer overflow (CWE-121); exposure needs BGP + multi-agent model. RCE is the vendor's 'may be possible' for a sophisticated attacker, not demonstrated. No known exploitation per Arista. Social search skipped (brand-new, not needed).

## Documents

- [advisory] Arista Security Advisory 0208 (CVE-2026-121289) https://www.arista.com/en/support/advisories-notices/security-advisory/25030-security-advisory-0208

## From the sources

On affected platforms running Arista EOS with BGP configured, a specially crafted packet can cause the BGP agent to crash.

Successful exploitation causes the BGP agent process to terminate, resulting in the loss of all BGP sessions on the affected device and possible disruption to network routing until the process recovers. Due to the nature of the vulnerability, it may also be possible for a sophisticated attacker to achieve arbitrary code execution, which could compromise the confidentiality and integrity of the affected system.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_