Skip to content
OpenAdvisories
Low · 1.7 CVE-2025-62601 EUVD-2025-206631

FastDDS has heap buffer overflow in readString via Manipulated DATA Submessage when DDS Security is enabled

Published Feb 3, 2026 · Updated Feb 3, 2026 · Assigned by GitHub_M

Description

Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group
). Prior to versions 3.4.1, 3.3.1, and 2.6.11, when the security mode is enabled, modifying the DATA Submessage within an
SPDP packet sent by a publisher causes a heap buffer overflow, resulting in remote termination of Fast-DDS. If the fields
of `PID_IDENTITY_TOKEN` or `PID_PERMISSIONS_TOKEN` in the DATA Submessage — specifically by tampering with the `str_size`
value read by `readString` (called from `readBinaryProperty`) — are modified, a 32-bit integer overflow can occur, causing
`std::vector::resize` to use an attacker-controlled size and quickly trigger heap buffer overflow and remote process term
ination. Versions 3.4.1, 3.3.1, and 2.6.11 patch the issue.

Affected products

VendorProductAffectedFixed
eProsima Fast-DDS 3.4.0 – < 3.4.1, 3.0.0 – < 3.3.1, < 2.6.11 3.4.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 13 fastdds No fix yet —
Debian 12 fastdds No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 fastdds No fix yet —
Ubuntu 26.04 LTS fastdds No fix yet —
Ubuntu 25.10 fastdds No fix yet —
Ubuntu 24.04 LTS fastdds No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS fastdds No fix yet —

References