CVE-2025-62799: Fast DDS Buffer Overflow Vulnerability

CVE-2025-62799 Overview

CVE-2025-62799 is a heap buffer overflow vulnerability in eProsima Fast DDS, a C++ implementation of the Data Distribution Service (DDS) standard from the Object Management Group (OMG). The vulnerability exists in the Fast-DDS DATA_FRAG receive path, where an unauthenticated attacker can transmit a single malformed RTPS DATA_FRAG packet with crafted fragmentSize and sampleSize values that violate internal assumptions. Due to a 4-byte alignment step during fragment metadata initialization, the code writes past the end of the allocated payload buffer, resulting in immediate crash (Denial of Service) and potentially enabling memory corruption with Remote Code Execution risk.

Critical Impact

Unauthenticated remote attackers can crash Fast DDS applications or potentially achieve remote code execution by sending a single malformed network packet. Systems using DDS for real-time data distribution in robotics, autonomous vehicles, and industrial IoT are at significant risk.

Affected Products

• eProsima Fast DDS versions prior to 3.4.1
• eProsima Fast DDS versions prior to 3.3.1
• eProsima Fast DDS versions prior to 2.6.11

Discovery Timeline

• 2026-02-03 - CVE-2025-62799 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2025-62799

Vulnerability Analysis

This heap buffer overflow vulnerability (CWE-122) affects the RTPS (Real-Time Publish-Subscribe) protocol implementation in Fast DDS. The flaw is specifically located in the DATA_FRAG packet processing logic, which handles fragmented data transmission between DDS participants. When processing incoming DATA_FRAG packets, the code performs a 4-byte alignment operation during fragment metadata initialization. However, the validation logic fails to properly account for this alignment step when checking buffer boundaries.

An attacker can craft a malicious RTPS packet where the fragmentSize and sampleSize fields are specifically designed to pass initial validation checks but cause the alignment operation to extend beyond the allocated buffer space. This results in heap corruption when the code writes metadata past the buffer boundary.

The network-accessible nature of the vulnerability is particularly concerning because Fast DDS is designed to operate in distributed real-time systems where network accessibility is fundamental to its operation. Systems commonly using Fast DDS include ROS 2 (Robot Operating System 2) deployments, autonomous vehicle platforms, industrial automation systems, and aerospace applications.

Root Cause

The root cause is improper validation of the relationship between fragmentSize, sampleSize, and the actual allocated payload buffer size before the 4-byte alignment operation. The alignment step is applied without verifying that the resulting write offset remains within the bounds of the heap-allocated buffer. This allows crafted input values to bypass boundary checks and trigger an out-of-bounds write condition during fragment metadata initialization.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker with network access to a Fast DDS participant can send a specially crafted RTPS DATA_FRAG packet to trigger the vulnerability. The attack is possible because:

1. The attacker constructs an RTPS packet with the DATA_FRAG submessage type
2. The fragmentSize and sampleSize fields are set to values that pass initial validation but cause buffer overflow after alignment
3. When the victim's Fast DDS instance processes this packet, the 4-byte alignment operation causes a write past the allocated heap buffer
4. The immediate result is a crash (DoS), with potential for controlled memory corruption leading to code execution

The vulnerability can be exploited remotely without user interaction, making it particularly dangerous for internet-exposed or insufficiently segmented DDS deployments. Technical details regarding the specific exploitation mechanics can be found in the GitHub commit references for the patches.

Detection Methods for CVE-2025-62799

Indicators of Compromise

• Unexpected crashes or segmentation faults in Fast DDS applications, particularly during network packet processing
• Anomalous RTPS DATA_FRAG packets with unusual fragmentSize or sampleSize values in network traffic
• Heap corruption indicators in application crash dumps or core files
• Increased network traffic targeting DDS participant discovery ports (typically UDP 7400-7410 range)

Detection Strategies

• Deploy network intrusion detection rules to identify malformed RTPS DATA_FRAG packets with suspicious fragment metadata combinations
• Monitor for process crashes in Fast DDS applications using system monitoring tools and correlate with network activity
• Implement application-level logging to capture packet processing errors before crash conditions
• Use memory safety tooling (AddressSanitizer, Valgrind) in development and testing environments to identify heap overflow conditions

Monitoring Recommendations

• Enable verbose logging in Fast DDS to capture RTPS packet processing details for forensic analysis
• Deploy network traffic analysis on DDS communication channels to detect anomalous packet patterns
• Configure crash reporting and core dump collection for Fast DDS processes to support post-incident analysis
• Establish baseline network behavior for DDS traffic to identify deviations indicative of exploitation attempts

How to Mitigate CVE-2025-62799

Immediate Actions Required

• Update eProsima Fast DDS to patched versions: 3.4.1, 3.3.1, or 2.6.11 depending on your release branch
• Implement network segmentation to restrict access to DDS participant communication ports from untrusted networks
• Deploy network firewalls or access control lists to limit which hosts can send RTPS traffic to vulnerable systems
• Monitor Fast DDS deployments for crashes or abnormal behavior while preparing for updates

Patch Information

eProsima has released patches for all supported release branches. The fixes address the heap buffer overflow by implementing proper boundary validation that accounts for the 4-byte alignment operation before performing writes to the payload buffer.

Patched versions:

• Branch 3.4.x: Update to 3.4.1 or later
• Branch 3.3.x: Update to 3.3.1 or later
• Branch 2.6.x: Update to 2.6.11 or later

The patches can be obtained from the official eProsima Fast DDS repository. Specific commits implementing the fix include:

• Commit 0c3824e
• Commit 955c8a1
• Commit d6dd58f

Workarounds

• Isolate Fast DDS deployments behind network firewalls that restrict RTPS traffic to trusted participants only
• Implement network-level filtering to drop malformed or suspicious RTPS packets before they reach vulnerable applications
• Use DDS security features (if available in your deployment) to require authentication before accepting data from other participants
• Consider deploying intrusion prevention systems capable of deep packet inspection of RTPS protocol traffic

# Example: Restrict DDS discovery and data ports using iptables
# Allow only trusted network (192.168.1.0/24) to access DDS ports
iptables -A INPUT -p udp --dport 7400:7410 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 7400:7410 -j DROP