Heap Buffer Overflow in Fast DDS by eProsima

CVE-2025-62602

What is CVE-2025-62602?

Fast DDS, a C++ implementation of the Data Distribution Service standard by eProsima, faces a heap buffer overflow vulnerability when the security mode is activated. An attacker can exploit this by modifying the DATA Submessage within an SPDP packet sent by a publisher. Specifically, tampering with fields like PID_IDENTITY_TOKEN or PID_PERMISSIONS_TOKEN allows the exploitation of unchecked vector sizes during data handling. This manipulation can trigger a 32-bit integer overflow in the length calculation, leading to an out-of-memory condition. The issue results in a remotely-triggerable denial-of-service scenario along with the potential for remote process termination. The vulnerability has been addressed in versions 3.4.1, 3.3.1, and 2.6.11.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References