SB2026040999 - Multiple vulnerabilities in Fast DDS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026040999

SB2026040999 - Multiple vulnerabilities in Fast DDS

Published: April 9, 2026

Security Bulletin ID SB2026040999
Severity
High
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 89% Medium 11%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 secuirty vulnerabilities.


1) Excessive Iteration (CVE-ID: CVE-2025-65016)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to excessive iteration in StatefulReader::NotifyChanges() when processing RTPS HEARTBEAT submessages with a crafted large firstSequenceNumber value under RELIABLE QoS. A remote attacker can send a specially crafted HEARTBEAT packet to cause a denial of service.

Exploitation requires network reachability to the reader on the DDS domain and endpoint matching to have created a WriterProxy on the subscriber.


2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2025-64438)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in StatefulReader::processGapMsg() when processing RTPS GAP submessages under RELIABLE QoS. A remote attacker can send a specially crafted GAP packet with a huge gap range to cause a denial of service.

A single small GAP message can trigger multi-GB heap growth and process termination.


3) Heap-based buffer overflow (CVE-ID: CVE-2025-62799)

The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the RTPS DATA_FRAG receive path when processing a malformed RTPS DATA_FRAG packet. A remote attacker can send a specially crafted DATA_FRAG packet with crafted fragmentSize and sampleSize values to execute arbitrary code or cause a denial of service.

The issue affects reachable RELIABLE subscribers receiving RTPS over UDP, and no user interaction is required.


4) Uncontrolled Memory Allocation (CVE-ID: CVE-2025-62603)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to memory allocation with excessive size value in the CDRMessage::readDataHolderSeq parser when parsing ParticipantGenericMessage DataHolderSeq data. A remote attacker can send a specially crafted network message to cause a denial of service.

Only deployments with DDS Security enabled are vulnerable.


5) Heap-based buffer overflow (CVE-ID: CVE-2025-62602)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in CDRMessage::readData when processing a manipulated DATA submessage in an SPDP packet with DDS Security enabled. A remote attacker can send a specially crafted packet to cause a denial of service.

Only deployments with DDS Security enabled are vulnerable.


6) Uncontrolled Memory Allocation (CVE-ID: CVE-2025-64098)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to memory allocation with excessive size value in CDRMessage::readOctetVector when parsing a manipulated DATA submessage in an SPDP packet. A remote attacker can send a specially crafted network packet to cause a denial of service.

Only deployments with DDS Security enabled are vulnerable.


7) Heap-based buffer overflow (CVE-ID: CVE-2025-62601)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in CDRMessage::readString when parsing a manipulated DATA submessage in an SPDP packet. A remote attacker can send a specially crafted SPDP packet to cause a denial of service.

Only deployments with DDS Security enabled are vulnerable.


8) Integer overflow (CVE-ID: CVE-2025-62600)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in CDRMessage::readBinaryPropertySeq when processing a manipulated DATA submessage in an SPDP packet. A remote attacker can send a specially crafted SPDP packet to cause a denial of service.

Only deployments with DDS Security enabled are vulnerable.


9) Integer overflow (CVE-ID: CVE-2025-62599)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in CDRMessage::readPropertySeq when processing a manipulated DATA submessage in an SPDP packet. A remote attacker can send a specially crafted SPDP packet to cause a denial of service.

Only deployments with DDS Security enabled are vulnerable.


Remediation

Install update from vendor's website.

References