Heap Buffer Overflow Vulnerability in Fast DDS Implementation by eProsima

CVE-2025-62601

What is CVE-2025-62601?

The Fast DDS implementation, prior to versions 3.4.1, 3.3.1, and 2.6.11, is susceptible to a heap buffer overflow when the security mode is enabled. This vulnerability arises when a malicious actor modifies the DATA Submessage within an SPDP packet sent by a publisher. Specifically, alterations to the PID_IDENTITY_TOKEN or PID_PERMISSIONS_TOKEN fields—particularly through tampering with the str_size value accessed by the readString function—can lead to a critical size manipulation. Such manipulation may trigger a 32-bit integer overflow, resulting in the std::vector::resize function allocating an attacker-controlled size, culminating in a heap buffer overflow and ultimately causing the remote termination of the Fast DDS process.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References