CVE-2025-62799highCWE-122

CVE-2025-62799: falha de alta gravidade em eProsima Fast-DDS

FastDDS's heap buffer overflow in RTPS DATA_FRAG enables unauthenticated DoS (potential RCE)

Publicada em

Seguir esta CVE+ Monitorar Fast-DDS+ Monitorar fastdds

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.2epss 0.5%
Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6.11, a heap buffer overflow exists in the Fast-DDS DATA_FRAG receive path. An un authenticated sender can transmit a single malformed RTPS DATA_FRAG packet where `fragmentSize` and `sampleSize` are craft ed to violate internal assumptions. Due to a 4-byte alignment step during fragment metadata initialization, the code write s past the end of the allocated payload buffer, causing immediate crash (DoS) and potentially enabling memory corruption ( RCE risk). Versions 3.4.1, 3.3.1, and 2.6.11 patch the issue.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Produtos afetados
eProsima · Fast-DDS
CVEs relacionadas — eProsima Fast-DDS

No mesmo produto, das mais perigosas para as menos.

CVE-2023-39949HIGHImproper validation of sequence numbers leading to remotely reachable assertion failureEPSS 1.0%CVE-2023-39948HIGHUncaught fastcdr exception (Unexpected CDR type received) crashing fastddsEPSS 1.0%CVE-2023-39534HIGHMalformed GAP submessage triggers assertion failureEPSS 1.0%CVE-2023-42459HIGHMalformed DATA submessage leads to bad-free error in Fast-DDSEPSS 1.0%CVE-2023-39947HIGHAnother heap overflow in push_back_helperEPSS 1.0%CVE-2024-28231CRITICALManipulated DATA Submessage causes a heap-buffer-overflow errorEPSS 0.9%