Out-Of-Memory Vulnerability in Fast DDS by eProsima

CVE-2025-64098

What is CVE-2025-64098?

Fast DDS, a C++ implementation of the DDS standard, has a vulnerability that can lead to an Out-Of-Memory condition when security mode is enabled. This occurs if a publisher modifies the DATA Submessage in an SPDP packet, particularly through tampering with the PID_IDENTITY_TOKEN or PID_PERMISSIONS_TOKEN fields. Such manipulation can trigger a 32-bit integer overflow due to an attack on the vecsize value in the readOctetVector operation. This flaw allows for an attacker-controlled size request in std::vector::resize, which can result in the remote termination of the Fast DDS process. Users are advised to upgrade to versions 3.4.1, 3.3.1, or 2.6.11 to mitigate this issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References