CVE-2021-38445 - CVE House
Back to Database
Status published High CVE-2021-38445

OCI OpenDDS Secure Improper Handling of Length Parameter Inconsistency

Vulnerability Description

OCI OpenDDS versions prior to 3.18.1 do not handle a length parameter consistent with the actual length of the associated data, which may allow an attacker to remotely execute arbitrary code.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-38445

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Federico Maggi (Trend Micro Research), Ta-Lun Yen, and Chizuru Toyama (TXOne Networks, Trend Micro) reported these vulnerabilities to CISA. In addition, Patrick Kuo, Mars Cheng (TXOne Networks, Trend Micro), Víctor Mayoral-Vilches (Alias Robotics), and Erik Boasson (ADLINK Technology) also contributed to this research.

References

More from OCI

View All →
CVE-2021-38447
OCI OpenDDS Secure Amplification
High 8.6
CVE-2021-38429
OCI OpenDDS Secure Network Amplification
Medium 6.6

Affected Vendor

Affected Software

OpenDDS
Vulnerable Versions:
unspecified

Timeline

Official Publish: May 5th, 2022
Last Modified: April 16th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Weaknesses (CWE)

CWE-130

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.