CVE-2025-62603
📋 TL;DR
Fast DDS versions prior to 3.4.1, 3.3.1, and 2.6.11 contain a vulnerability where malicious ParticipantGenericMessage packets can trigger excessive memory allocation during CDR parsing, leading to out-of-memory conditions and process termination. This affects systems using Fast DDS for DDS communication, particularly in real-time and IoT applications. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- Fast DDS (formerly Fast RTPS)
📦 What is this software?
Fast Dds by Eprosima
Fast Dds by Eprosima
Fast Dds by Eprosima
⚠️ Risk & Real-World Impact
Worst Case
Remote denial of service causing process termination and service disruption in critical systems using Fast DDS for communication.
Likely Case
Remote denial of service through process termination, disrupting DDS-based communication in affected systems.
If Mitigated
Minimal impact if patched versions are deployed or if systems are isolated from untrusted networks.
🎯 Exploit Status
Exploitation requires sending malicious DDS packets to vulnerable endpoints; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.1, 3.3.1, or 2.6.11
Vendor Advisory: https://github.com/eProsima/Fast-DDS/security/advisories
Restart Required: Yes
Instructions:
1. Identify Fast DDS version. 2. Upgrade to 3.4.1, 3.3.1, or 2.6.11 depending on your branch. 3. Recompile applications using Fast DDS. 4. Restart all Fast DDS processes.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to Fast DDS endpoints to trusted networks only.
Use firewall rules to block untrusted access to DDS ports (typically 7400-7410 UDP/TCP)
Resource Limits
allSet memory limits on Fast DDS processes to contain impact.
ulimit -v [LIMIT] (Linux)
Set-ProcessMitigation (Windows)
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure to trusted sources only.
- Monitor process memory usage and restart services if abnormal consumption is detected.
🔍 How to Verify
Check if Vulnerable:
Check Fast DDS version; if below 3.4.1, 3.3.1, or 2.6.11, system is vulnerable.Check Version:
Check application documentation or build configuration for Fast DDS version; or use 'strings' on binaries containing Fast DDS libraries.Verify Fix Applied:
Confirm Fast DDS version is 3.4.1, 3.3.1, or 2.6.11 or higher.📡 Detection & Monitoring
Log Indicators:
- Process termination logs
- Out-of-memory errors in system/application logs
- Abnormal memory consumption patterns
Network Indicators:
- Unusual volume of ParticipantGenericMessage traffic
- Malformed DDS packets to port 7400-7410
SIEM Query:
Process termination events from Fast DDS applications OR memory allocation failures in application logs🔗 References
- https://github.com/eProsima/Fast-DDS/commit/354218514d32beac963ff5c306f1cf159ee37c5f
- https://github.com/eProsima/Fast-DDS/commit/a726e6a5daba660418d1f7c05b6f203c17747d2b
- https://github.com/eProsima/Fast-DDS/commit/ced3b6f92d928af1eae77d5fe889878128ad421a
- https://security-tracker.debian.org/tracker/CVE-2025-62603
