CVE-2026-73462: Arista EOS IGMP Snooping DoS Vulnerability

CVE-2026-73462 Overview

CVE-2026-73462 is a denial-of-service vulnerability in Arista EOS affecting the Internet Group Management Protocol (IGMP) snooping agent. IGMP snooping is enabled by default on all VLANs, exposing default deployments to attack. A network-adjacent unauthenticated attacker can send malformed packets on an affected VLAN and terminate the snooping agent. The failure disrupts multicast traffic management and causes multicast frames to flood every port in the affected VLAN until the service recovers. Repeated exploitation extends the disruption and degrades intended multicast forwarding behavior. The issue is tracked under [CWE-125] (out-of-bounds read).

Critical Impact
An adjacent attacker can crash the IGMP snooping agent on Arista EOS, causing multicast flooding across the VLAN and prolonged loss of multicast forwarding on repeated exploitation.

Affected Products

Arista EOS platforms with IGMP snooping enabled (default on all VLANs)
Refer to Arista Security Advisory #0159 for the authoritative list of affected EOS versions and hardware
Deployments relying on IGMP snooping for multicast traffic optimization

Discovery Timeline

2026-09-16 - CVE-2026-73462 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73462

Vulnerability Analysis

The vulnerability resides in the IGMP snooping agent that inspects multicast group management traffic on Arista EOS. Parsing of malformed IGMP frames triggers an out-of-bounds read, causing the agent to terminate unexpectedly. When the agent is down, the switch loses its dynamic multicast group membership state for the VLAN. EOS falls back to flooding multicast traffic to every port in that VLAN, saturating links and exposing multicast streams to hosts that should not receive them. Recovery is automatic once the agent restarts, but continued malformed traffic keeps the agent in a crash loop and extends the disruption window.

Root Cause

The defect is an out-of-bounds read ([CWE-125]) in the IGMP packet parsing path. The agent processes fields in received IGMP messages without adequate bounds validation. A specially crafted packet causes memory access beyond the intended buffer and terminates the process.

Attack Vector

Exploitation requires network adjacency to a VLAN where IGMP snooping is enabled. No authentication or user interaction is needed. The attacker sends malformed IGMP packets from any host on the affected VLAN. Because IGMP snooping is on by default, most Arista EOS deployments are exposed without configuration changes. The impact is limited to availability of multicast forwarding on the affected VLAN; confidentiality and integrity of the switch are not directly affected.

No public proof-of-concept code is available. See Arista Security Advisory #0159 for authoritative technical details.

Detection Methods for CVE-2026-73462

Indicators of Compromise

Unexpected termination or repeated restarts of the IGMP snooping agent process in EOS event logs
Sudden multicast flooding to all ports within a VLAN that previously had constrained multicast delivery
Malformed IGMP packets originating from a single host on a VLAN over a short interval

Detection Strategies

Monitor EOS AgentMonitor and SysDB logs for Igmpsnooping agent crashes or restart events
Alert on sustained increases in multicast traffic volume on access ports that normally receive no multicast
Correlate IGMP packet anomalies with switch process termination events in the SIEM

Monitoring Recommendations

Ingest EOS syslog and eAPI telemetry into a centralized data lake for correlation of agent restarts with network anomalies
Baseline normal IGMP query, report, and leave rates per VLAN and alert on statistical deviations
Track multicast forwarding table churn as a proxy for snooping agent stability

How to Mitigate CVE-2026-73462

Immediate Actions Required

Review Arista Security Advisory #0159 and identify affected EOS versions in your fleet
Apply the fixed EOS release or hotfix provided by Arista as soon as maintenance windows permit
Restrict access to VLANs carrying sensitive multicast traffic and enforce port security on untrusted access ports

Patch Information

Arista has published remediation guidance in Security Advisory #0159. Consult the advisory for the specific EOS train fixes and any available Software Maintenance Upgrade (SMU) hotfixes applicable to your platform. Upgrading to a fixed EOS release is the recommended long-term remediation.

Workarounds

Disable IGMP snooping on VLANs where multicast optimization is not required, using no ip igmp snooping vlan <id>
Apply control-plane and ingress ACLs to filter malformed or unexpected IGMP traffic from untrusted ports
Segment untrusted hosts into dedicated VLANs to limit the blast radius of a snooping agent crash

bash

# Configuration example: disable IGMP snooping on a specific VLAN
switch(config)# no ip igmp snooping vlan 100

# Verify current IGMP snooping state
switch# show ip igmp snooping vlan 100