CVE-2025-62601
Severity CVSS v4.0:
LOW
Type:
CWE-122
Heap-based Buffer Overflow
Publication date:
03/02/2026
Last modified:
03/02/2026
Description
Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group<br />
). Prior to versions 3.4.1, 3.3.1, and 2.6.11, when the security mode is enabled, modifying the DATA Submessage within an <br />
SPDP packet sent by a publisher causes a heap buffer overflow, resulting in remote termination of Fast-DDS. If the fields <br />
of `PID_IDENTITY_TOKEN` or `PID_PERMISSIONS_TOKEN` in the DATA Submessage — specifically by tampering with the `str_size` <br />
value read by `readString` (called from `readBinaryProperty`) — are modified, a 32-bit integer overflow can occur, causing<br />
`std::vector::resize` to use an attacker-controlled size and quickly trigger heap buffer overflow and remote process term<br />
ination. Versions 3.4.1, 3.3.1, and 2.6.11 patch the issue.
References to Advisories, Solutions, and Tools
- https://github.com/eProsima/Fast-DDS/commit/354218514d32beac963ff5c306f1cf159ee37c5f
- https://github.com/eProsima/Fast-DDS/commit/a726e6a5daba660418d1f7c05b6f203c17747d2b
- https://github.com/eProsima/Fast-DDS/commit/ced3b6f92d928af1eae77d5fe889878128ad421a
- https://security-tracker.debian.org/tracker/CVE-2025-62601