# CVE-2025-65865: eProsima Fast-DDS integer overflow in DataFrag sub-message processing

Source: https://junglewise.ai/threats/cve-2025-65865-eprosima-fast-dds-integer-overflow-in-datafrag-sub-message  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-23. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-65865 · Severity: high · CVSS 7.5 · Published 2025-12-23

eProsima Fast-DDS is a software framework used for real-time data exchange in robotics, automotive, and industrial systems. A vulnerability in how it handles specific network messages allows an attacker to crash the system by sending a specially crafted data packet. This results in a denial-of-service, potentially disrupting critical communications and operational safety in environments relying on this middleware.

Technologies: [Eprosima Fast Dds](https://junglewise.ai/threats/technologies/fast-dds). Vendors: [Eprosima](https://junglewise.ai/threats/vendors/eprosima).

## Quick answers

**Is CVE-2025-65865 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-65865 being exploited in the wild.

**How severe is CVE-2025-65865?** High severity, with a CVSS score of 7.5, published 23 December 2025.

**Which products and versions are affected?** Eprosima Fast Dds 3.3.0.

**Is there a fix for CVE-2025-65865?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-65865 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-65865?** Check whether you run Eprosima Fast Dds at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability exists in eProsima Fast-DDS v3.3 within the processing of RTPS protocol DataFrag sub-messages. Specifically, the `proc_Submsg_DataFrag` function in `MessageReceiver.cpp` suffers from an integer underflow when `submessageLength` is smaller than the combined `octetsToInlineQos` and `inlineQosSize`. This results in an extremely large `payload_size` value, leading to an out-of-bounds access for the `msg->pos` pointer. Consequently, a subsequent `memcpy` operation in the `add_fragments` function attempts to copy excessive data, causing a segmentation fault or potential arbitrary memory read. Attackers can exploit this over UDP if they can monitor the target's GUID and entityId.

## Affected products

- eProsima Fast-DDS 3.3.0

## Timeline

- 2025-12-23: disclosed: Initial vulnerability disclosure and CVE assignment.

## References

- [http://fast-dds.com/](http://fast-dds.com/)
- [https://gist.github.com/lkloliver/7aa48cb9fc7a1dd74cb595212bb69d33](https://gist.github.com/lkloliver/7aa48cb9fc7a1dd74cb595212bb69d33)
- [https://github.com/lkloliver/poc/blob/main/Detail.md](https://github.com/lkloliver/poc/blob/main/Detail.md)

## Related threats

- [eProsima Fast DDS stack exhaustion in DDSSQLFilter parser](https://junglewise.ai/threats/cve-2026-22591-eprosima-fast-dds-stack-exhaustion-in-ddssqlfilter-parser)
- [eprosima Fast DDS out-of-bounds read in DATA_FRAG processing](https://junglewise.ai/threats/cve-2026-22590-eprosima-fast-dds-out-of-bounds-read-in-data-frag-processing)
- [eProsima Fast-DDS improper certificate revocation validation](https://junglewise.ai/threats/cve-2025-67108-eprosima-fast-dds-improper-certificate-revocation-validation)
- [eProsima Fast-DDS v3.3 and before has an infinite loop vulnerability caused by integer overflow in the Time_t:: fraction() function.](https://junglewise.ai/threats/cve-2025-63829-eprosima-fast-dds-v3-3-and-before-has-an-infinite-loop)