Executive brief
eprosima Fast DDS is a middleware library that enables real-time communication between distributed applications using the DDS standard. A remotely triggerable memory-reading vulnerability allows an attacker to craft malicious network packets that cause the application to read beyond its allocated buffer, leaking sensitive data from the server's heap memory (such as pointers and internal data structures) to other participants in the network. In Discovery Server deployments, this leaked information can be relayed to newly joining participants, potentially aiding more sophisticated attacks like ASLR bypass.
Technical details
This is an out-of-bounds read vulnerability (CWE-125) in Fast DDS's RTPS protocol message handler, specifically in the processing of DATA_FRAG (fragmented data) submessages. The vulnerability exists in the `CacheChange_t::add_fragments()` function, which fails to validate that the actual received payload length meets the declared `sampleSize`. An attacker can craft a malicious DATA_FRAG message with a large `sampleSize` value but only a small actual UDP payload, then set `fragmentsInSubmessage` to mark the packet as the final fragment. The vulnerable code then computes `incoming_length` from `sampleSize` and calls `memcpy()` without bounds checking, causing it to read past the UDP datagram buffer into adjacent heap memory. The attack requires network access to a Fast DDS participant or Discovery Server (UDP). In Discovery Server deployments, the leaked heap contents are stored in the CacheChange_t and relayed to other participants, making the data exposure more serious. Patches are available in versions 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2.
Affected products
- eprosima Fast DDS < 2.6.12, < 2.14.6, < 3.2.4, < 3.3.1, < 3.4.2
Timeline
- 2026-07-23: disclosed
- 2026-07-23: patched: Versions 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 released
- 2026-09-09: advisory