CVE-2026-22590: eprosima Fast DDS out-of-bounds read in DATA_FRAG processing

CVE-2026-22590 · Severity: critical · CVSS 9.1 · Published 2026-09-09

eprosima Fast DDS is a middleware library that enables real-time communication between distributed applications using the DDS standard. A remotely triggerable memory-reading vulnerability allows an attacker to craft malicious network packets that cause the application to read beyond its allocated buffer, leaking sensitive data from the server's heap memory (such as pointers and internal data structures) to other participants in the network. In Discovery Server deployments, this leaked information can be relayed to newly joining participants, potentially aiding more sophisticated attacks like ASLR bypass.

Technologies: Eprosima Fast Dds. Vendors: Eprosima.

Quick answers

Is CVE-2026-22590 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-22590 being exploited in the wild.
How severe is CVE-2026-22590?
Critical severity, with a CVSS score of 9.1, published 9 September 2026.
Which products and versions are affected?
Eprosima Fast Dds < 2.6.12, < 2.14.6, < 3.2.4, < 3.3.1, < 3.4.2.
Is there a fix for CVE-2026-22590?
A patch was published on 2026-07-23: Versions 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22590 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-22590?
Check whether you run Eprosima Fast Dds at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an out-of-bounds read vulnerability (CWE-125) in Fast DDS's RTPS protocol message handler, specifically in the processing of DATA_FRAG (fragmented data) submessages. The vulnerability exists in the `CacheChange_t::add_fragments()` function, which fails to validate that the actual received payload length meets the declared `sampleSize`. An attacker can craft a malicious DATA_FRAG message with a large `sampleSize` value but only a small actual UDP payload, then set `fragmentsInSubmessage` to mark the packet as the final fragment. The vulnerable code then computes `incoming_length` from `sampleSize` and calls `memcpy()` without bounds checking, causing it to read past the UDP datagram buffer into adjacent heap memory. The attack requires network access to a Fast DDS participant or Discovery Server (UDP). In Discovery Server deployments, the leaked heap contents are stored in the CacheChange_t and relayed to other participants, making the data exposure more serious. Patches are available in versions 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2.

Affected products

  • eprosima Fast DDS < 2.6.12, < 2.14.6, < 3.2.4, < 3.3.1, < 3.4.2

Timeline

  • 2026-07-23: disclosed
  • 2026-07-23: patched: Versions 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 released
  • 2026-09-09: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.