CVE Intelligence
Analysis AI-assisted

CVE-2025-62799: Fast DDS heap buffer overflow in DATA_FRAG receive path

Fast DDS, a C++ implementation of the OMG DDS standard, contains a heap buffer overflow in its DATA_FRAG receive path that a single malformed RTPS packet from an unauthenticated sender can trigger. The record describes an immediate crash (denial of service) and a potential for memory corruption, referred to as an RCE risk. Fixed versions named in the record are 3.4.1, 3.3.1 and 2.6.11.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Fast DDS is a C++ implementation of the OMG Data Distribution Service (DDS) standard. The record describes a heap buffer overflow in the DATA_FRAG receive path that a single malformed RTPS packet from an unauthenticated sender can trigger.

Impact

  • Immediate crash of the affected application, described as denial of service.
  • The record also describes a potential for memory corruption, labeled as an RCE risk. The sources consulted do not confirm code execution.

Affected products and versions

  • Eprosima Fast DDS: versions below 2.6.11, versions from 3.0.0 up to but not including 3.3.1, and version 3.4.0, as listed in the record.
  • Fixed versions named in the description: 3.4.1, 3.3.1 and 2.6.11.
  • The record also lists Debian Debian Linux versions 11.0, 12.0 and 13.0 as affected entries. It does not explain how Debian packages relate to Fast DDS. See the Debian security tracker.

Exploitation status

This CVE is not listed in the CISA KEV catalog according to the record. No confirmed exploitation in the wild appears in the sources consulted. No EPSS score is available.

Remediation and mitigation

  • Upgrade Fast DDS to 3.4.1, 3.3.1 or 2.6.11 depending on your release branch. Fix commits are linked in the references.
  • Inventory systems that embed Fast DDS, including Linux distribution packages, since embedding applications may be affected indirectly.
  • Where an upgrade cannot be applied immediately, restrict RTPS traffic to trusted network segments. This is general defensive guidance, not a vendor recommendation contained in the record.

Detection guidance

  • Monitor DDS-based applications for unexpected crashes or restarts, which may indicate attempted exploitation.
  • Review network logs for RTPS traffic arriving from untrusted sources at the boundaries of DDS domains.

Limitations of the available information

  • The record gives an NVD CVSS 3.1 score of 9.8 and a GitHub CNA CVSS 4.0 score of 7.2. No other scoring is available.
  • The record does not provide a proof of concept, the exact vulnerable code path, or the Debian fix status.
  • The sources do not confirm whether remote code execution is achievable.

Frequently asked questions

What is CVE-2025-62799?

It is a heap buffer overflow in the DATA_FRAG receive path of Eprosima Fast DDS, triggered by a single malformed RTPS packet from an unauthenticated sender.

Which Fast DDS versions are fixed?

The record states that versions 3.4.1, 3.3.1 and 2.6.11 patch the issue. Upgrade the branch you use to the matching fixed release.

Is this vulnerability known to be exploited?

The record does not list this CVE in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.