# CVE-2026-121292

Arista EOS RPKI agent crash and memory disclosure via malformed Error Report

- Page: https://www.vulneraibility.com/cve/CVE-2026-121292
- CVSS: 8.3
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-125
- Published: 2026-11-10

## Affected versions

- Arista Networks EOS: affected 4.37.0F; >= 4.36.0F and <= 4.36.2F; >= 4.35.0F and <= 4.35.6M; >= 4.34.0F and <= 4.34.8M; >= 4.33.0F and <= 4.33.10M; >= 4.24.0F and < 4.33.0F

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote attacker can send a malformed RPKI Error Report to crash the RPKI agent (DoS) and cause memory disclosure via logs, potentially exposing sensitive data and disrupting routing.

## Action

Immediate action required

## Recommendation

Apply vendor update when released; restrict/validate RPKI peers and monitor logs.

## References

- [advisory] https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.