What is the CVSS score of CVE-2026-38891?

CVE-2026-38891 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of gazebo_plugins are affected by CVE-2026-38891?

Gazebo_plugins v3.9.0 contains a denial-of-service vulnerability in the differential-drive controller with publicly available exploit code that allows attackers to crash robot-control and simulation…

How to fix or mitigate CVE-2026-38891?

Within 24 hours: Inventory all systems running gazebo_plugins v3.9.0 and assess operational criticality; implement access controls restricting ROS topic publishers to authorized systems only. Within 7 days: Deploy input validation middleware to sanitize geometry_msgs::Twist messages before processing; submit urgent inquiry to gazebo maintainers regarding patch availability and timeline. Within 30 days: Evaluate migration options to patched versions when released; implement network segmentation isolating robot-control systems; conduct comprehensive ROS infrastructure access-control review.

gazebo_plugins CVE-2026-38891

EUVD-2026-41221 HIGH

Improper Input Validation (CWE-20)

2026-07-01 cve@mitre.org

GHSA-866x-255q-hx3g

Denial Of Service

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated ROS topics give PR:N and a single crafted message gives AC:L; impact is a controller crash (A:H) with no confidentiality or integrity effect, though AV:N assumes ROS network reachability.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 17:00 vuln.today

CVSS changed

Jul 02, 2026 - 14:52 NVD

7.5 (HIGH)

CVE Published

Jul 01, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An improper input validation in the gazebo_ros_diff_drive.cpp component of gazebo_plugins v3.9.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted geometry_msgs::Twist message.

AnalysisAI

Denial of service in the gazebo_plugins package (v3.9.0), specifically the differential-drive controller gazebo_ros_diff_drive.cpp, lets attackers crash the affected simulation/robot-control node by publishing a specially crafted geometry_msgs::Twist velocity command. Any actor able to reach the relevant ROS topic can trigger the fault because the plugin fails to validate the incoming message before processing it (CWE-20). Reported via MITRE with a public proof-of-concept (demo video and technical write-up); not listed in CISA KEV, and EPSS exploitation probability is low at 0.15% (5th percentile).

Technical ContextAI

gazebo_plugins provides ROS-integrated plugins for the Gazebo robotics simulator; gazebo_ros_diff_drive is the differential-drive controller that subscribes to a cmd_vel-style topic carrying geometry_msgs::Twist messages (linear and angular velocity vectors) and translates them into wheel commands. The root cause is CWE-20 (Improper Input Validation): the plugin consumes attacker-controllable numeric fields from the Twist message without sanity/bounds checking, so a crafted message (e.g., malformed or out-of-range values such as NaN/Inf or extreme magnitudes) drives the plugin into a crashing or unrecoverable state, denying availability of the controller/simulation. ROS 1 topic transport is unauthenticated by design, so message injection depends only on network reachability to the ROS graph rather than on any credential.

RemediationAI

No vendor-released patched version is identified in the provided data at time of analysis, and EUVD does not enumerate a fixed release, so track the gazebo_plugins/gazebo_ros upstream project for a corrected release and upgrade off 3.9.0 once published. As compensating controls, restrict who can publish to the differential-drive command topic: isolate the ROS master and topics on a dedicated, firewalled robot network segment (never expose the ROS master port, default 11311, or DDS discovery ports to untrusted networks), and where feasible migrate to ROS 2 with SROS2/DDS security to authenticate and authorize publishers - the trade-off is configuration and performance overhead. Additionally, add input validation/clamping (reject NaN/Inf and bound velocity magnitudes) at the consuming node or via a filtering relay node in front of the diff-drive controller; the side effect is added latency and the need to tune acceptable velocity ranges. Consult the technical write-up at https://github.com/REYu6/ROS-vul/blob/main/Gazebo%20CVE/gazebo_ros_diff_drive.md for the exact crafted-message pattern to filter.