CVE-2026-28532 - FRRouting < 10.5.3 Integer Overflow in OSPF TLV Parser Functions

Back Back to CVE browser

MEDIUM

FRRouting < 10.5.3 Integer Overflow in OSPF TLV Parser Functions

Published Apr 30, 2026

6.0

MEDIUM

CVSS 4.0

EPSS 0.37%

Description

FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.

Affected products

Vendor FRRouting Product Frr Default
affected
- Version
  0
  Status
  affected
  Constraints
  <10.5.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

FRRouting

Frr

affected

Version	Status	Constraints
0	affected	<10.5.3

Red Hat Enterprise Linux 10

frr

Fix deferred
Red Hat Enterprise Linux 8

frr

Fix deferred
Red Hat Enterprise Linux 9

frr

Fix deferred
Red Hat Enterprise Linux 9

frr10

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	frr	Fix deferred	n/a
Red Hat Enterprise Linux 8	frr	Fix deferred	n/a
Red Hat Enterprise Linux 9	frr	Fix deferred	n/a
Red Hat Enterprise Linux 9	frr10	Fix deferred	n/a

Remediation

Red Hat statement

Moderate impact. This flaw in FRRouting's OSPF TLV parser functions can lead to a denial of service. An attacker with an established OSPF adjacency can send a specially crafted packet, triggering out-of-bounds memory reads and crashing routers within the OSPF area or autonomous system. Exploitation requires network proximity and an active OSPF peering relationship.

Weaknesses (2)

CWE-125

Out-of-bounds Read

CWE-190

Integer Overflow

References (9)

https://access.redhat.com/security/cve/CVE-2026-28532
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2464230
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26418
Advisory
https://github.com/FRRouting/frr/commit/f098decf02987fbf1c891766c1516ac832adadfd
patch
https://github.com/FRRouting/frr/pull/21002
issue-trackingIssue TrackingPatch
https://github.com/FRRouting/frr/releases/tag/frr-10.5.3
release-notesRelease Notes
https://nvd.nist.gov/vuln/detail/CVE-2026-28532
https://www.cve.org/CVERecord?id=CVE-2026-28532
https://www.vulncheck.com/advisories/frrouting-integer-overflow-in-ospf-tlv-parser-functions
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-28532		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2464230		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26418		Advisory
https://github.com/FRRouting/frr/commit/f098decf02987fbf1c891766c1516ac832adadfd		patch
https://github.com/FRRouting/frr/pull/21002		issue-trackingIssue TrackingPatch
https://github.com/FRRouting/frr/releases/tag/frr-10.5.3		release-notesRelease Notes
https://nvd.nist.gov/vuln/detail/CVE-2026-28532
https://www.cve.org/CVERecord?id=CVE-2026-28532
https://www.vulncheck.com/advisories/frrouting-integer-overflow-in-ospf-tlv-parser-functions		third-party-advisoryThird Party Advisory