Executive brief
OpenDDS is an open-source middleware that enables real-time distributed communication between applications. A network attacker can crash an OpenDDS participant by sending a specially crafted network message, causing the service to terminate and disrupting all connected clients and data flows. The attack requires no authentication or user interaction and can be launched by any network-adjacent party.
Technical details
This is a denial-of-service vulnerability caused by insufficient bounds checking in the RTPS UDP receive handler. An attacker sends a malformed RTPS UDP submessage with a crafted length or sequence-number state that causes the RtpsUdpReceiveStrategy::handle_input() function to advance the read pointer (rd_ptr()) beyond the valid data region in an ACE_Message_Block. The subsequent RtpsSampleHeader::init() call dereferences this invalid pointer without validating it against the write pointer (wr_ptr()), resulting in a segmentation fault (SIGSEGV) in the receive thread that terminates the entire DDS process. No prior authentication, protocol state, or victim interaction is required; a network-reachable OpenDDS participant is sufficient. The vulnerability is fixed in version 3.34.0.
Affected products
- OpenDDS OpenDDS prior to 3.34.0
Timeline
- 2026-09-17: disclosed
- 2026: patched: fixed in version 3.34.0