CVE-2025-62602
Gravedad CVSS v4.0:
BAJA
Tipo:
CWE-122
Desbordamiento de búfer basado en memoria dinámica (Heap)
Fecha de publicación:
03/02/2026
Última modificación:
03/02/2026
Descripción
*** Pendiente de traducción *** Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group<br />
). Prior to versions 3.4.1, 3.3.1, and 2.6.11, when the security mode is enabled, modifying the DATA Submessage within an <br />
SPDP packet sent by a publisher causes a heap buffer overflow, resulting in remote termination of Fast-DDS. If the fields <br />
of `PID_IDENTITY_TOKEN` or `PID_PERMISSIONS_TOKEN` in the DATA Submessage are tampered with — specially `readOctetVector`<br />
reads an unchecked `vecsize` that is propagated unchanged into `readData` as the `length` parameter — the attacker-contro<br />
lled `vecsize` can trigger a 32-bit integer overflow during the `length` calculation. That overflow can cause large alloca<br />
tion attempt that quickly leads to OOM, enabling a remotely-triggerable denial-of-service and remote process termination. <br />
Versions 3.4.1, 3.3.1, and 2.6.11 patch the issue.
Referencias a soluciones, herramientas e información
- https://github.com/eProsima/Fast-DDS/commit/354218514d32beac963ff5c306f1cf159ee37c5f
- https://github.com/eProsima/Fast-DDS/commit/a726e6a5daba660418d1f7c05b6f203c17747d2b
- https://github.com/eProsima/Fast-DDS/commit/ced3b6f92d928af1eae77d5fe889878128ad421a
- https://security-tracker.debian.org/tracker/CVE-2025-62602