Integer overflow in Fast DDS - CVE-2025-63829
Published: November 9, 2026
Vulnerability identifier: #VU162812
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-63829
CWE-ID: CWE-190
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker who can control QoS policy parameters to cause a denial of service in Fast DDS.
The vulnerability exists due to integer overflow in the Time_t::fraction() function when the QoS policy's nanosec parameter is set to 1000000000. An attacker who can control QoS policy parameters can trigger an infinite loop during time conversion, preventing the affected operation from completing.
Affected software
Fast DDS
How to mitigate CVE-2025-63829
Install security update from vendor's website.
Fast DDS - addressed in versions 2.6.12, 2.14.7, 3.2.5, 3.4.3, 3.6.2