CVE-2025-62799
📋 TL;DR
A heap buffer overflow vulnerability in Fast DDS allows unauthenticated attackers to send a single malformed RTPS DATA_FRAG packet, causing immediate crashes (DoS) and potentially enabling remote code execution. This affects all systems using vulnerable versions of Fast DDS for DDS communication. The vulnerability stems from improper handling of fragment metadata during 4-byte alignment.
💻 Affected Systems
- Fast DDS (formerly Fast RTPS)
📦 What is this software?
Fast Dds by Eprosima
Fast Dds by Eprosima
Fast Dds by Eprosima
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or persistent backdoor installation.
Likely Case
Denial of service through application crashes, disrupting DDS-based communication systems.
If Mitigated
Limited impact if network segmentation prevents external access to DDS endpoints.
🎯 Exploit Status
The vulnerability requires sending a specially crafted RTPS DATA_FRAG packet to a vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.1, 3.3.1, or 2.6.11
Vendor Advisory: https://github.com/eProsima/Fast-DDS/security/advisories
Restart Required: Yes
Instructions:
1. Identify current Fast DDS version. 2. Upgrade to patched version (3.4.1, 3.3.1, or 2.6.11). 3. Recompile applications using Fast DDS. 4. Restart all services using Fast DDS.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to DDS endpoints using firewalls to trusted sources only.
Disable DATA_FRAG Reception
allConfigure Fast DDS to reject DATA_FRAG packets if not required for functionality.
🧯 If You Can't Patch
- Implement strict network access controls to limit DDS traffic to trusted internal networks only.
- Deploy intrusion detection systems to monitor for malformed RTPS packets and alert on exploitation attempts.
🔍 How to Verify
Check if Vulnerable:
Check Fast DDS version against vulnerable ranges (<3.4.1, <3.3.1, <2.6.11).Check Version:
Check build configuration or use 'fastdds --version' if available, or examine source/build files.Verify Fix Applied:
Confirm version is 3.4.1, 3.3.1, or 2.6.11 or higher, and test with valid RTPS traffic.📡 Detection & Monitoring
Log Indicators:
- Application crashes, segmentation faults, or abnormal termination of Fast DDS processes
Network Indicators:
- Malformed RTPS packets with crafted fragmentSize/sampleSize values
SIEM Query:
Process termination events for Fast DDS executables OR network alerts for RTPS protocol anomalies🔗 References
- https://github.com/eProsima/Fast-DDS/commit/0c3824ef4991628de5dfba240669dc6172d63b46
- https://github.com/eProsima/Fast-DDS/commit/955c8a15899dc6eb409e080fe7dc89e142d5a514
- https://github.com/eProsima/Fast-DDS/commit/d6dd58f4ecd28cd1c3bc4ef0467be9110fa94659
- https://security-tracker.debian.org/tracker/CVE-2025-62799
