EUVD-2026-75058Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Remote, unauthenticated, low-complexity out-of-bounds read yields high heap disclosure (C:H); no integrity impact, and availability only via possible crash (A:L rather than A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS DATA_FRAG submessages. An attacker can craft a DATA_FRAG with a large sampleSize but a small actual payload, and set fragmentsInSubmessage such that the receiver treats the packet as the LAST fragment**. In this LAST-fragment path, Fast-DDS computes incoming_length based on sampleSize and calls memcpy() without validating incoming_data.length >= incoming_length. As a result, CacheChange_t::add_fragments() reads past the received UDP datagram buffer and into adjacent heap memory, copying those bytes into the reassembly buffer. In a Discovery Server deployment, the resulting CacheChange_t can be relayed to other participants, meaning that a newly joining participant may receive leaked heap memory (e.g., pointer values that could aid ASLR bypass). Versions 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 fix the issue.
AnalysisAI
Remote heap information disclosure in eProsima Fast DDS lets unauthenticated attackers leak adjacent heap memory by sending a crafted RTPS DATA_FRAG submessage. Affected versions before 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 fail to validate that the received datagram is large enough before a memcpy() in the last-fragment reassembly path, so bytes past the UDP buffer (potentially pointers useful for ASLR bypass) are copied into the reassembly buffer and, in Discovery Server deployments, relayed to other participants. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to send a single crafted RTPS DATA_FRAG submessage to a reachable Fast DDS participant over the network (default UDP transport), with a large sampleSize, a small actual payload, and fragmentsInSubmessage set so the packet is processed via the LAST-fragment reassembly path in CacheChange_t::add_fragments(). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, base 9.1) reflects a genuinely low-barrier remote, unauthenticated, low-complexity condition with no user interaction, which is the dominant risk driver here. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Fast DDS 2.6.12, 2.14.6, 3.2.4, 3.3.1, or 3.4.2 (whichever matches your current release line) per advisory GHSA-7r7h-hwfj-q626 (https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-7r7h-hwfj-q626); rebuild and redeploy any ROS 2 or embedded software that statically links the affected library. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running eProsima Fast DDS and document current versions, prioritizing Discovery Server deployments and production systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote denial of service in eProsima Fast-DDS v3.3.0 allows unauthenticated network attackers to crash affected processe
FastDDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Ra
FastDDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Ra
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Rate
Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). R
An issue was discovered in eProsima FastDDS v.2.14.0 and before, allows a local attacker to cause a denial of service (D
Improper validation of permissions/ticket revocation in eProsima Fast-DDS 3.3.0 allows revoked or no-longer-valid securi
Fast DDS (eProsima) has a heap buffer overflow in its C++ DDS implementation that allows remote attackers to execute cod
An issue was discovered in eProsima FastDDS v.2.14.0 and before, allows a local attacker to cause a denial of service (D
Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ).
Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ).
Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ).
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today