EUVD-2026-82339Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach participant's RTPS/UDP port
-
DeliverySend malformed submessage with crafted length
-
Exploitrd_ptr advanced beyond valid data
-
Executioninit() dereferences invalid pointer
-
PersistSIGSEGV crashes receive thread
-
ImpactDDS process and entities destroyed
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of OpenDDS participants that expose an RTPS/UDP transport endpoint reachable by the attacker. The only prerequisite is network reachability to the participant's RTPS UDP port; a single malformed submessage with a crafted length or sequence-number state triggers the crash. Limiting factors are minimal: no authentication (PR:N), no user interaction (UI:N), and no non-default feature toggle is required, though impact is confined to availability (the process is killed, not compromised) and requires the target to be running an affected version prior to 3.34.0 with the rtps_udp transport in use. |
| Impact | This is a genuine, well-characterized remote denial-of-service vulnerability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: fully network-reachable, low complexity, no authentication, no user interaction, and pure availability impact (crash of the DDS participant) with no confidentiality or integrity loss. The 8.7 score is high precisely because it is trivially triggerable and unauthenticated, but it is availability-ONLY - there is no code execution or data disclosure despite the CWE-125 OOB read (the invalid rd_ptr is dereferenced for a read that faults, not leaked). No EPSS score, KEV listing, or public POC was provided; exploitation status is therefore 'no public exploit identified at time of analysis.' The fix is delivered via a GitHub Security Advisory (GHSA-wcr7-gccq-vv56) with concrete commits, so the vulnerability and patch are vendor-confirmed. Net: a real and easy-to-trigger DoS worth prioritizing on exposed OpenDDS participants, but not a confidentiality/integrity or RCE threat - the 'Information Disclosure' tag overstates impact and conflicts with VC:N. |
| Exploit ScenarioDerived | An attacker with network reachability to an OpenDDS participant's RTPS/UDP endpoint sends a single crafted RTPS submessage whose declared length or sequence-number state drives RtpsUdpReceiveStrategy::handle_input() to advance the ACE_Message_Block read pointer past valid data. RtpsSampleHeader::init() then dereferences the invalid pointer without validating it against wr_ptr(), producing a SIGSEGV in the receive thread that terminates the process and destroys all DDS entities it hosts. No authentication, prior protocol state, or victim interaction is required; no public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Remote, unauthenticated denial of service in OpenDDS versions prior to 3.34.0: any network attacker who can reach an OpenDDS participant's RTPS/UDP endpoint can crash the node by sending a single malformed RTPS submessage, killing the DDS process and taking down every DDS entity hosted by that participant. Exploitation requires no credentials, no prior protocol handshake, and no victim interaction - the crafted length or sequence-number state simply drives the receive parser past the end of the valid data, causing a SIGSEGV in the receive thread. Impact is confined to availability (the process terminates rather than being taken over), and fixed builds are available in 3.34.0; no public exploit code was identified at time of analysis and there is no confirmed active exploitation.
RemediationAI
Upgrade to OpenDDS 3.34.0 or later - this is the vendor-released patch and the release that resolves CVE-2026-52836 (https://github.com/OpenDDS/OpenDDS/releases/tag/v3.34.0), with the underlying fixes in commits 3ded3341e89db88e4c4e09d5153e05730b0a84ce, b46382ebc50d46f933ad6c860a396bffa97adbd7, d6bdddde9ee07f9ee0b461680e5fb64f95cd1251 and e5aee3f5b18ee7174d66c3e7818270e1ba2cc2fa via PR #5210, and advisory GHSA-wcr7-gccq-vv56. Because the flaw is a crash-on-parse in the receive thread, there is no configuration change that makes an affected build safe; if upgrading cannot be done immediately, the practical compensating controls are network-level: firewall or ACL the RTPS/UDP port range used by the affected participants so that only known peer hosts (rather than any host on the segment) can deliver UDP datagrams, and place participants behind a segmented network boundary or VPN. The trade-off is that RTPS discovery and user traffic rely on the same UDP endpoints, so over-restrictive filtering breaks peer discovery and can silently reduce the participant graph; allowlisting known peers by source address/port is preferable to blocking the port outright. Where the deployment permits it, switching the affected participants to a non-UDP transport (for example a TCP-based or shared-memory transport) removes the attack surface at the cost of losing UDP multicast discovery and its latency/scale benefits, and is not a drop-in substitute for multicast-heavy designs. Additionally, enable automatic restart/supervision of the DDS process (systemd Restart=, container restart policy) and alert on unexpected process exits so that any residual crash is detected and recovered quickly, and monitor OpenDDS participant logs for repeated abrupt terminations that would indicate an attempt to exploit this issue.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenDDS is an open-source C++ implementation of the OMG Data Distribution Service (DDS), and the vulnerability lives in its RTPS-over-UDP receive path. In dds/DCPS/transport/rtps_udp/RtpsUdpReceiveStrategy.cpp, RtpsUdpReceiveStrategy::handle_input() advances ACE_Message_Block::rd_ptr() based on attacker-controlled submessage length or sequence-number state without re-validating that the read pointer still lies within the buffer. Parsing then proceeds into dds/DCPS/transport/rtps_udp/RtpsSampleHeader.cpp, where RtpsSampleHeader::init() dereferences that now-invalid read pointer without first checking it against wr_ptr() or confirming that a complete submessage header (SMHDR_SZ bytes) remains. This is the classic out-of-bounds read pattern (CWE-125), and because the malformed data is consumed in the receive thread, the resulting SIGSEGV is not contained - it terminates the process and destroys the DDS entities hosted by that participant. The upstream fix (PR #5210) hardens RtpsSampleHeader::init() by walking the ACE_Message_Block chain via cont() and validating the cursor on every block, and by capturing total_length() before computing the contiguous span and comparing it against SMHDR_SZ, so a truncated or pointer-skewed submessage is rejected instead of dereferenced. Note that the aligned CVSS 3.1 assessment scores confidentiality and integrity as None and availability as High, which is consistent with an out-of-bounds read that crashes the parser rather than leaking or corrupting application data; some third-party tagging labels this issue as a buffer overflow and information disclosure, but that characterization is not supported by the authoritative impact assessment and the code evidence points to a read-past-end that manifests as a crash.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote, low-complexity, unauthenticated, no interaction; single malformed packet crashes the process for availability-only impact, so C:N/I:N/A:H.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). Prior to 3.34.0, a network attacker can crash a reachable OpenDDS participant by sending a malformed RTPS UDP submessage whose crafted length or sequence-number state causes dds/DCPS/transport/rtps_udp/RtpsUdpReceiveStrategy.cpp in RtpsUdpReceiveStrategy::handle_input() to advance ACE_Message_Block::rd_ptr() beyond valid data. The parser can then call dds/DCPS/transport/rtps_udp/RtpsSampleHeader.cpp in RtpsSampleHeader::init(), which dereferences the invalid read pointer without first validating it against wr_ptr() or ensuring that a complete submessage header remains. The resulting SIGSEGV occurs in the receive thread, terminates the DDS process, and destroys the DDS entities hosted by that participant. No authentication, prior protocol state, or victim interaction is required. This issue is fixed in version 3.34.0.
Technical POC Analysis
CWE-125 (out-of-bounds read).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
A remotely reachable flaw in OpenDDS, the middleware used to move real-time data between distributed components, allows a single malformed network message to terminate the DDS process and take down every application entity hosted by that node. Organizations running OpenDDS releases earlier than 3.34.0 in command-and-control, telemetry, simulation, or industrial data pipelines should treat this as an availability risk to any service whose uptime depends on continuous DDS transport, since recovery requires process restart and re-establishment of all participating entities. No public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor fix is already available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB