CVE-2023-42459 - CVE House

Back to Database

Status published High CVE-2023-42459

Malformed DATA submessage leads to bad-free error in Fast-DDS

8.6 CVSS

Vulnerability Description

Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). In affected versions specific DATA submessages can be sent to a discovery locator which may trigger a free error. This can remotely crash any Fast-DDS process. The call to free() could potentially leave the pointer in the attackers control which could lead to a double free. This issue has been addressed in versions 2.12.0, 2.11.3, 2.10.3, and 2.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-42459

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from eProsima

View All →

Fast-DDS: Unbounded GAP range triggers OOM DoS under RELIABLE QoS

FastDDS has Out-of-memory in readOctetVector via Manipulated DATA Submessage when DDS Security is enabled

FastDDS's heap buffer overflow in RTPS DATA_FRAG enables unauthenticated DoS (potential RCE)

FastDDS has Out-of-memory while parsing GenericMessage when DDS Security is enabled

FastDDS has heap buffer overflow in readData via Manipulated DATA Submessage when DDS Security is enabled

Affected Vendor

eProsima

View all reports →

Affected Software

Fast-DDS

Vulnerable Versions:

>= 2.11.0, <= 2.11.1, >= 2.10.0, < 2.10.3, < 2.6.7

Timeline

Official Publish: October 16th, 2023

Last Modified: February 13th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Weaknesses (CWE)

CWE-415 CWE-416 CWE-590

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1190 Exploit Public-Facing Application

T1574 Hijack Execution Flow

Privilege Escalation

T1059 Command and Scripting Interpreter

T1485 Data Destruction

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1055 Process Injection

Defense Evasion

T1105 Ingress Tool Transfer

Command and Control