Executive brief
eProsima Fast-DDS is a software framework used for real-time data exchange in robotics, automotive, and industrial systems. A vulnerability in how it handles specific network messages allows an attacker to crash the system by sending a specially crafted data packet. This results in a denial-of-service, potentially disrupting critical communications and operational safety in environments relying on this middleware.
Technical details
An integer overflow vulnerability exists in eProsima Fast-DDS v3.3 within the processing of RTPS protocol DataFrag sub-messages. Specifically, the `proc_Submsg_DataFrag` function in `MessageReceiver.cpp` suffers from an integer underflow when `submessageLength` is smaller than the combined `octetsToInlineQos` and `inlineQosSize`. This results in an extremely large `payload_size` value, leading to an out-of-bounds access for the `msg->pos` pointer. Consequently, a subsequent `memcpy` operation in the `add_fragments` function attempts to copy excessive data, causing a segmentation fault or potential arbitrary memory read. Attackers can exploit this over UDP if they can monitor the target's GUID and entityId.
Affected products
- eProsima Fast-DDS 3.3.0
Timeline
- 2025-12-23: disclosed: Initial vulnerability disclosure and CVE assignment.