In order to be vulnerable to CVE-2025-8872, the following condition must be met:
The OSFPv3 protocol must be configured in either the default or non default vrf and at least one neighbor must be present
switch>show ospfv3\nOSPFv3 address-family ipv6\nRouting Process \"ospfv3\" with ID 192.0.2.0 and Instance 0 VRF default\n FIPS mode disabled\n Maximum number of LSAs allowed 0\n Exceed action disable\n LSA limit for warning message 75%\n Disabled-time 5 minutes, clear timeout 5 minutes\n Incident count 0, incident count limit 5\n It is an autonomous system boundary router and is not an area border router\n Minimum LSA arrival interval 1000 msecs\n Initial LSA throttle delay 1000 msecs\n Minimum hold time for LSA throttle 5000 msecs\n Maximum wait time for LSA throttle 5000 msecs\n It has 1 fully adjacent neighbors\n Number of areas in this router is 1. 1 normal, 0 stub, 0 nssa\n Number of LSAs 8\n Initial SPF schedule delay 0 msecs\n Minimum hold time between two consecutive SPFs 5000 msecs\n Current hold time between two consecutive SPFs 5000 msecs\n Maximum wait time between two consecutive SPFs 5000 msecs\n SPF algorithm last executed 00:04:52 ago\n No scheduled SPF\n Adjacency exchange-start threshold is 20\n Maximum number of next-hops supported in ECMP is 128\n Number of backbone neighbors is 0\n Graceful-restart is not configured\n Graceful-restart-helper mode is enabled\n Area 0.0.0.0\n Number of interface in this area is 1\n It is a normal area\n SPF algorithm executed 6 times\n \nswitch>show ospfv3 neighbor\nOSPFv3 address-family ipv6\nRouting Process \"ospfv3\" Instance 0 VRF default\nNeighbor 192.0.3.0 VRF default priority is 1, state is Full\n In area 0.0.0.0 interface Ethernet4\n Adjacency was established 00:00:49 ago\n Current state was established 00:00:49 ago\n DR is 3.3.3.3 BDR is 2.2.2.2\n Options is E R V6\n Dead timer is due in 29 seconds\n Graceful-restart-helper mode is Inactive\n Graceful-restart attempts: 0\n
If OSFPv3 is not configured there is no exposure to this issue and the show command will not produce any output
switch>show ospfv3\n \nswitch>show ospfv3 neighbor
On affected platforms running Arista EOS with OSPFv3 configured, a specially crafted packet can cause the OSFPv3 process to have high CPU utilization which may result in the OSFPv3 process being restarted. This may cause disruption in the OSFPv3 routes on the switch.
This issue was discovered internally by Arista and is not aware of any malicious uses of this issue in customer networks.
The recommended resolution is to upgrade to a remediated software version at your earliest convenience.
Arista recommends customers move to the latest version of each release that contains all the fixes listed below.
For more information about upgrading see: EOS User Manual: Upgrades and Downgrades