Medium 6.5Published Apr 30, 2026

CVE-2026-28532FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t…

Updated under an hour ago (2026-10-19 06:50 UTC)

Does this affect you?

It affects frrouting. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for frrouting

Exploited in the last 30 days

FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.

CVSS: 6.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-125, CWE-190
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Analyzed
Record last updated: Jun 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

frrouting frrouting frrouting:frrouting	before 10.5.3	NVD

References

https://github.com/FRRouting/frr/commit/f098decf02987fbf1c891766c1516ac832adadfdpatch
https://github.com/FRRouting/frr/pull/21002issue-tracking, patch
https://github.com/FRRouting/frr/releases/tag/frr-10.5.3release-notes
https://www.vulncheck.com/advisories/frrouting-integer-overflow-in-ospf-tlv-parser-functionsthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.