{"id":"CVE-2026-121292","kind":"vulnerability","aliases":["CVE-2026-121292"],"related":[],"title":"Arista EOS: malformed RPKI Error Report reads past packet bounds, can restart the RPKI agent","description":"A malformed Error Report can cause EOS to read beyond packet boundaries, potentially terminating the RPKI agent or exposing unintended memory contents through logging.","summary":"Arista Security Advisory 0222 (Nov 10, 2026): a malformed RPKI-to-Router Error Report from the RPKI cache makes EOS read past packet bounds. It can terminate or restart the RPKI agent, or expose memory contents through logging. Found internally by Arista, which knows of no exploitation. Arista states no mitigation and no hotfix exist; upgrade.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EOS","fixed":["4.36.3M","4.35.7M","4.34.9M","4.33.11M"],"affected":"4.37.0F; <= 4.36.2F; <= 4.35.6M; <= 4.34.8M; <= 4.33.10M; all 4.24.0F to 4.32.x (End of Support)","ecosystem":"vendor"}],"ecosystems":[],"tags":["arista","bgp","eos","infrastructure","network-devices","rpki"],"not_affected_if":["no-rpki-cache-configured"],"how_to_check":"Run 'show bgp rpki cache' on the switch; if no RPKI cache is configured under 'router bgp' (rpki cache <name> / host <addr>) and no RPKI-RTR session is established, the issue cannot be reached. Then check 'show version' against the affected ranges. Indicator: grep 'Received malformed Error Report PDU from cache server' /var/log/eos.","fix":"Upgrade EOS to 4.36.3M or later (4.36.x), 4.35.7M or later (4.35.x), 4.34.9M or later (4.34.x), or 4.33.11M or later (4.33.x). Arista lists no fixed release for 4.37.0F and for the End of Support trains from 4.24.0F; move to a supported fixed train. No hotfix.","status":"open","published_at":"2026-11-10T20:18:54+00:00","first_seen_at":"2026-11-10T20:46:03+00:00","triaged_at":"2026-11-10T20:47:35+00:00","updated_at":"2026-11-10T20:56:38+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-10T20:47:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"EOS: malformed Error Report reads past packet bounds, crashes RPKI agent","impact":"medium","summary":"A malformed Error Report makes EOS read beyond the packet boundary. An attacker can terminate the RPKI agent or expose unintended memory contents through logging.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["rpki","eos","network-devices"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"RPKI agent crashes and unintended memory contents leak through logs","analyst_note":"Find the vendor advisory for CVE-2026-121292 to confirm affected EOS versions, fixed releases and whether RPKI is enabled by default.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000641,"input_tokens":4510,"output_tokens":379,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory for CVE-2026-121292 to confirm affected EOS versions, fixed releases and whether RPKI is enabled by default.","search":"'-121292':18A,21A '-2026':17A,20A '0222':34B '10':36B '2026':37B 'advisori':33B 'agent':15A,63B,104C 'arista':1A,23B,31B,73B,79B 'beyond':97C 'bgp':24B 'bound':10A,55B 'boundari':99C 'cach':49B 'caus':93C 'content':67B,109C 'cve':16A,19A 'devic':29B 'eo':2A,25B,51B,94C 'eos':22A 'error':5A,44B,90C 'exist':86B 'exploit':78B 'expos':65B,106C 'found':70B 'hotfix':85B 'infrastructur':26B 'intern':71B 'know':75B 'log':69B,111C 'make':50B 'malform':3A,39B,89C 'memori':66B,108C 'mitig':82B 'network':28B 'network-devic':27B 'nov':35B 'packet':9A,54B,98C 'past':8A,53B 'potenti':100C 'read':7A,52B,96C 'report':6A,45B,91C 'restart':12A,60B 'router':43B 'rpki':4A,14A,30B,41B,48B,62B,103C 'rpki-to-rout':40B 'secur':32B 'state':80B 'termin':58B,101C 'unintend':107C 'upgrad':87B","nicknames":[],"mitigations":[],"who_affected":"Arista EOS-based switches and routers (7xxx series, AWE, ZTX-7200, CloudEOS, cEOS-lab, vEOS-lab, CloudVision eXchange) that have an RPKI cache configured and an active RPKI-RTR session for BGP origin validation. An attacker controlling the RPKI cache or the path to it can send the crafted message. Devices without RPKI cache configuration, and CloudVision Portal, Wi-Fi APs, NetVisor, DMF and the other products Arista lists, are not affected.","tier":"B","verified":{"fix":{"at":"2026-11-10T20:56:38Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222","run_id":2726},"products":{"at":"2026-11-10T20:56:38Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222","run_id":2726},"how_to_check":{"at":"2026-11-10T20:56:38Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222","run_id":2726},"who_affected":{"at":"2026-11-10T20:56:38Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222","run_id":2726}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["eos"],"ptokens":["eos"],"labels":["arista","bgp","eos","high","infrastructure","networkdevices","rpki"],"campaign_type":null,"search_a":"'-121292':18A,21A '-2026':17A,20A 'agent':15A 'arista':1A 'bound':10A 'cve':16A,19A 'eo':2A 'eos':22A 'error':5A 'malform':3A 'packet':9A 'past':8A 'read':7A 'report':6A 'restart':12A 'rpki':4A,14A","search_b":"'0222':34B '10':36B '2026':37B 'advisori':33B 'agent':63B 'arista':23B,31B,73B,79B 'bgp':24B 'bound':55B 'cach':49B 'content':67B 'devic':29B 'eo':25B,51B 'error':44B 'exist':86B 'exploit':78B 'expos':65B 'found':70B 'hotfix':85B 'infrastructur':26B 'intern':71B 'know':75B 'log':69B 'make':50B 'malform':39B 'memori':66B 'mitig':82B 'network':28B 'network-devic':27B 'nov':35B 'packet':54B 'past':53B 'read':52B 'report':45B 'restart':60B 'router':43B 'rpki':30B,41B,48B,62B 'rpki-to-rout':40B 'secur':32B 'state':80B 'termin':58B 'upgrad':87B","search_c":"'agent':104C 'beyond':97C 'boundari':99C 'caus':93C 'content':109C 'eo':94C 'error':90C 'expos':106C 'log':111C 'malform':89C 'memori':108C 'packet':98C 'potenti':100C 'read':96C 'report':91C 'rpki':103C 'termin':101C 'unintend':107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@arista.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121292","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121292","severity":null,"published_at":"2026-11-10T20:18:54+00:00","modified_at":"2026-11-10T20:18:54+00:00","first_seen_at":"2026-11-10T20:46:03+00:00","fetched_at":"2026-11-10T20:46:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121292:2726","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222","severity":null,"published_at":"2026-11-10T20:56:38+00:00","modified_at":"2026-11-10T20:56:38+00:00","first_seen_at":"2026-11-10T20:56:38+00:00","fetched_at":"2026-11-10T20:56:38+00:00","note":"Read Arista SA 0222 (primary). Affected versions, RPKI-cache precondition and fixes verified from vendor page. No PoC or exploitation known. Sibling CVE-2026-121291 is in the same advisory. 4.37.x fix not stated.","cites":["https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222"]}],"documents":[{"id":118336,"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222","title":"Arista Security Advisory 0222","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}