CVE-2025-64098lowCWE-125CWE-190

CVE-2025-64098: fallo de gravedad baja en eProsima Fast-DDS

FastDDS has Out-of-memory in readOctetVector via Manipulated DATA Submessage when DDS Security is enabled

Publicada el

Seguir esta CVE+ Monitorear Fast-DDS+ Monitorear fastdds

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 1.7epss 0.5%
Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6.11, when the security mode is enabled, modifying the DATA Submessage within an SPDP packet sent by a publisher causes an Out-Of-Memory (OOM) condition, resulting in remote termination of Fast-DDS. If t he fields of `PID_IDENTITY_TOKEN` or `PID_PERMISSIONS_TOKEN` in the DATA Submessage are tampered with — specifically by ta mpering with the the `vecsize` value read by `readOctetVector` — a 32-bit integer overflow can occur, causing `std::vector ::resize` to request an attacker-controlled size and quickly trigger OOM and remote process termination. Versions 3.4.1, 3 .3.1, and 2.6.11 patch the issue.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Productos afectados
eProsima · Fast-DDS
CVEs relacionadas — eProsima Fast-DDS

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-39949HIGHImproper validation of sequence numbers leading to remotely reachable assertion failureEPSS 1.0%CVE-2023-39948HIGHUncaught fastcdr exception (Unexpected CDR type received) crashing fastddsEPSS 1.0%CVE-2023-39534HIGHMalformed GAP submessage triggers assertion failureEPSS 1.0%CVE-2023-42459HIGHMalformed DATA submessage leads to bad-free error in Fast-DDSEPSS 1.0%CVE-2023-39947HIGHAnother heap overflow in push_back_helperEPSS 1.0%CVE-2024-28231CRITICALManipulated DATA Submessage causes a heap-buffer-overflow errorEPSS 0.9%