CVE-2025-62602
Severity CVSS v4.0:
LOW
Type:
CWE-122
Heap-based Buffer Overflow
Publication date:
03/02/2026
Last modified:
03/02/2026
Description
Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group<br />
). Prior to versions 3.4.1, 3.3.1, and 2.6.11, when the security mode is enabled, modifying the DATA Submessage within an <br />
SPDP packet sent by a publisher causes a heap buffer overflow, resulting in remote termination of Fast-DDS. If the fields <br />
of `PID_IDENTITY_TOKEN` or `PID_PERMISSIONS_TOKEN` in the DATA Submessage are tampered with — specially `readOctetVector`<br />
reads an unchecked `vecsize` that is propagated unchanged into `readData` as the `length` parameter — the attacker-contro<br />
lled `vecsize` can trigger a 32-bit integer overflow during the `length` calculation. That overflow can cause large alloca<br />
tion attempt that quickly leads to OOM, enabling a remotely-triggerable denial-of-service and remote process termination. <br />
Versions 3.4.1, 3.3.1, and 2.6.11 patch the issue.
References to Advisories, Solutions, and Tools
- https://github.com/eProsima/Fast-DDS/commit/354218514d32beac963ff5c306f1cf159ee37c5f
- https://github.com/eProsima/Fast-DDS/commit/a726e6a5daba660418d1f7c05b6f203c17747d2b
- https://github.com/eProsima/Fast-DDS/commit/ced3b6f92d928af1eae77d5fe889878128ad421a
- https://security-tracker.debian.org/tracker/CVE-2025-62602