CVE-2025-62799 - CVE House
Back to Database
Status published High CVE-2025-62799

FastDDS's heap buffer overflow in RTPS DATA_FRAG enables unauthenticated DoS (potential RCE)

Vulnerability Description

Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6.11, a heap buffer overflow exists in the Fast-DDS DATA_FRAG receive path. An un authenticated sender can transmit a single malformed RTPS DATA_FRAG packet where `fragmentSize` and `sampleSize` are craft ed to violate internal assumptions. Due to a 4-byte alignment step during fragment metadata initialization, the code write s past the end of the allocated payload buffer, causing immediate crash (DoS) and potentially enabling memory corruption ( RCE risk). Versions 3.4.1, 3.3.1, and 2.6.11 patch the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62799

Credits & Attribution

No credits recorded in the NVD database.

References

More from eProsima

View All →
CVE-2025-64438
Fast-DDS: Unbounded GAP range triggers OOM DoS under RELIABLE QoS
Low 1.7
CVE-2025-64098
FastDDS has Out-of-memory in readOctetVector via Manipulated DATA Submessage when DDS Security is enabled
Low 1.7
CVE-2025-62603
FastDDS has Out-of-memory while parsing GenericMessage when DDS Security is enabled
Low 1.7
CVE-2025-62602
FastDDS has heap buffer overflow in readData via Manipulated DATA Submessage when DDS Security is enabled
Low 1.7
CVE-2025-62601
FastDDS has heap buffer overflow in readString via Manipulated DATA Submessage when DDS Security is enabled
Low 1.7

Affected Vendor

Affected Software

Fast-DDS
Vulnerable Versions:
3.4.0, 3.0.0, 0

Timeline

Official Publish: February 3rd, 2026
Last Modified: February 3rd, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-122

MITRE ATT&CK TTPs

T1203 Exploitation for Client Execution
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion