CVE-2026-73462

Arista EOS switches running IGMP snooping (enabled by default on all VLANs) contain an out-of-bounds read flaw (CWE-125) in the IGMP snooping agent. A network-adjacent, unauthenticated attacker can trigger it by sending malformed packets onto an affected VLAN, causing the snooping agent to terminate unexpectedly. The impact is availability-focused: while the agent is down, multicast traffic management is disrupted and multicast traffic may be flooded to all ports of the affected VLAN, and repeated exploitation can prolong the loss of intended multicast forwarding. Any environment running Arista EOS where untrusted devices share a VLAN with multicast traffic is affected, notably data center, campus, and multi-tenant networks. As of now there is no evidence of exploitation in the wild, no known public proof-of-concept, and the issue is not listed in CISA's KEV catalog.

What to do: Check Arista's security advisory (assigned by [email protected]) for the fixed EOS release for your train and upgrade, since no fixed version can be confirmed from the available data. Until then, restrict untrusted layer-2 access to VLANs with IGMP snooping enabled (e.g., port security, ACLs, limiting guest/tenant access), and monitor device logs for unexpected IGMP snooping agent restarts as an indicator of attempted exploitation.