Fast DDS CVE-2026-22590

Exploitation requires the attacker to send a single crafted RTPS DATA_FRAG submessage to a reachable Fast DDS participant over the network (default UDP transport), with a large sampleSize, a small actual payload, and fragmentsInSubmessage set so the packet is processed via the LAST-fragment reassembly path in CacheChange_t::add_fragments(). No authentication, credentials, or user interaction are needed (AV:N/AC:L/PR:N/UI:N). Limiting factors: the attacker must have network-layer access to the DDS domain/RTPS ports (typically not exposed to the public internet in well-segmented deployments), and the highest-value outcome - leaked memory reaching third-party participants - depends on a Discovery Server topology; the amount and usefulness of leaked heap content is non-deterministic.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, base 9.1) reflects a genuinely low-barrier remote, unauthenticated, low-complexity condition with no user interaction, which is the dominant risk driver here. The primary impact is confidentiality (heap memory disclosure including pointer values that aid ASLR bypass); availability impact is plausible because an out-of-bounds read can crash the process, though the description emphasizes disclosure rather than DoS, so A:H may be slightly generous versus the read-only nature of the bug. No EPSS score, KEV listing, or public PoC was supplied, so there is no evidence of active or automated exploitation despite the high base score - this is currently a high-severity-but-unproven-in-the-wild issue, and any mid-sized operator running DDS on exposed segments should still prioritize patching given the trivial network prerequisites. The Discovery Server relay behavior meaningfully raises impact because leaked memory can propagate to newly joining participants beyond the initial victim.

An attacker with network reachability to a DDS participant sends a crafted RTPS DATA_FRAG submessage declaring a large sampleSize but carrying a small payload, with fragmentsInSubmessage set so the receiver treats it as the final fragment. Fast DDS then memcpy()s beyond the received datagram into adjacent heap memory, and in a Discovery Server deployment the resulting CacheChange_t propagates leaked heap bytes - potentially live pointers - to other participants, enabling ASLR bypass to support a follow-on memory-corruption exploit. No authentication or user interaction is required.