Memory Corruption Vulnerability in OpenDDS Data Distribution Service

CVE-2026-52836

What is CVE-2026-52836?

A memory corruption vulnerability exists in OpenDDS, an open-source C++ implementation of the Object Management Group (OMG) Data Distribution Service. Prior to version 3.34.0, a network attacker can exploit this vulnerability by sending a specially crafted RTPS UDP submessage. This submessage can manipulate the length or sequence-number state, leading to potential crashes of reachable OpenDDS participants. Specifically, it affects the handle_input method within RtpsUdpReceiveStrategy, causing it to advance an invalid pointer in the ACE_Message_Block. This results in a SIGSEGV error within the receive thread, terminating the DDS process and consequently destroying the hosted DDS entities. Importantly, this vulnerability does not require any authentication, prior protocol state, or interaction from the victim.

References