Skip to content
OpenAdvisories
Low · 1.7 CVE-2025-64098 EUVD-2025-206667

FastDDS has Out-of-memory in readOctetVector via Manipulated DATA Submessage when DDS Security is enabled

Published Feb 3, 2026 · Updated Feb 3, 2026 · Assigned by GitHub_M

Description

Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group
). Prior to versions 3.4.1, 3.3.1, and 2.6.11, when the security mode is enabled, modifying the DATA Submessage within an
SPDP packet sent by a publisher causes an Out-Of-Memory (OOM) condition, resulting in remote termination of Fast-DDS. If t
he fields of `PID_IDENTITY_TOKEN` or `PID_PERMISSIONS_TOKEN` in the DATA Submessage are tampered with — specifically by ta
mpering with the the `vecsize` value read by `readOctetVector` — a 32-bit integer overflow can occur, causing `std::vector
::resize` to request an attacker-controlled size and quickly trigger OOM and remote process termination. Versions 3.4.1, 3
.3.1, and 2.6.11 patch the issue.

Affected products

VendorProductAffectedFixed
eProsima Fast-DDS 3.4.0 – < 3.4.1, 3.0.0 – < 3.3.1, < 2.6.11 3.4.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 13 fastdds No fix yet —
Debian 12 fastdds No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 fastdds No fix yet —
Ubuntu 26.04 LTS fastdds No fix yet —
Ubuntu 25.10 fastdds No fix yet —
Ubuntu 24.04 LTS fastdds No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS fastdds No fix yet —

References