Description

eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS `DATA_FRAG` submessages. An attacker can craft a `DATA_FRAG` with a large `sampleSize` but a small actual payload, and set `fragmentsInSubmessage` such that the receiver treats the packet as the LAST fragment**. In this LAST-fragment path, Fast-DDS computes `incoming_length` based on `sampleSize` and calls `memcpy()` without validating `incoming_data.length >= incoming_length`. As a result, `CacheChange_t::add_fragments()` reads past the received UDP datagram buffer and into adjacent heap memory, copying those bytes into the reassembly buffer. In a Discovery Server deployment, the resulting `CacheChange_t` can be relayed to other participants, meaning that a newly joining participant may receive leaked heap memory (e.g., pointer values that could aid ASLR bypass). Versions 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 fix the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-09T16:17:02.387Z",
  "pubdate": "2026-09-09T16:17:02.387Z",
  "executiveSummary": "eProsima Fast DDS is susceptible to a remotely triggerable Out-of-Bounds (OOB) Read vulnerability when processing RTPS DATA_FRAG submessages.\nThe vulnerability stems from improper validation of length fields in fragmented RTPS packets, allowing an attacker to induce the application to read memory beyond the boundaries of the received UDP datagram buffer.\nSuccessful exploitation results in the leakage of adjacent heap memory, which can contain sensitive information such as memory addresses useful for bypassing Address Space Layout Randomization (ASLR).\nIn Discovery Server deployment architectures, the compromised CacheChange_t objects can be propagated to other participants, potentially exposing memory contents to unintended network entities.\nThe flaw affects multiple branches of the Fast DDS codebase, specifically versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2.\nThis vulnerability requires the ability to send maliciously crafted RTPS traffic to a target Fast DDS instance, posing a significant risk to confidentiality in distributed systems.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper validation of the sampleSize and fragmentsInSubmessage fields during the reassembly of fragmented RTPS data within the CacheChange_t::add_fragments() function.\nWhen processing a DATA_FRAG submessage, the implementation fails to verify that the length of the received data (incoming_data.length) is sufficient to accommodate the expected total sample size (incoming_length) specified in the packet headers.\nSpecifically, an attacker can craft a DATA_FRAG submessage where the sampleSize is intentionally large, but the actual payload is kept small. By manipulating the fragmentsInSubmessage field to indicate that the current packet constitutes the LAST fragment, the attacker forces the application into a vulnerable code path.\nIn this LAST-fragment execution path, the application calculates the incoming_length based on the attacker-supplied sampleSize and proceeds to execute a memcpy() operation using this value. Because the check incoming_data.length >= incoming_length is absent, the application reads memory contents starting from the end of the legitimate UDP datagram buffer and copies these bytes into the reassembly buffer.\nThis behavior facilitates an OOB Read, where the application copies arbitrary heap memory into the cache change structure. Because Fast DDS is used in high-performance robotics and industrial applications, this memory often contains pointers, configuration data, or other sensitive runtime structures.\nIn environments utilizing a Discovery Server, the maliciously crafted CacheChange_t object is treated as valid data. The Discovery Server may relay this 'poisoned' cache change to other participants in the DDS network. Consequently, a newly joining or existing participant may receive the data containing the leaked heap bytes, allowing an remote attacker to exfiltrate information without direct interaction with the final recipient.\nAffected versions include any deployment of eProsima Fast DDS prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2. No authentication is required to trigger this vulnerability, as it occurs during the standard processing of RTPS protocol messages over UDP. The exploitation allows for unauthorized memory disclosure, which fundamentally undermines the security posture of systems relying on ASLR for memory protection."
}