Heap Buffer Overflow in Fast DDS Implementation by eProsima

CVE-2025-62799

What is CVE-2025-62799?

Fast DDS, a C++ implementation of the Data Distribution Service standard, contains a vulnerability that allows an unauthenticated sender to exploit the DATA_FRAG receive path. By transmitting a specially crafted RTPS DATA_FRAG packet that violates internal assumptions regarding 'fragmentSize' and 'sampleSize', it triggers a heap buffer overflow. This leads to the possibility of immediate system crashes and could potentially result in memory corruption. The issue has been resolved in versions 3.4.1, 3.3.1, and 2.6.11.

References