CVE-2025-62602

CWE-122 — Heap-based Buffer OverflowCWE-787 — Out-of-bounds Write5 documents5 sources
Severity
1.7LOW
EPSS
0.0%
top 94.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Eprosima Fast-ddsEprosima Fast DDSDebian Debian Linux
Timeline
PublishedFeb 3

Description

Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6.11, when the security mode is enabled, modifying the DATA Submessage within an SPDP packet sent by a publisher causes a heap buffer overflow, resulting in remote termination of Fast-DDS. If the fields of `PID_IDENTITY_TOKEN` or `PID_PERMISSIONS_TOKEN` in the DATA Submessage are tampered with — specially `readOctetVector` reads an unchecke…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5eprosima/fast-dds3.4.0 — 3.4.1+2
▶NVDeprosima/fast_dds3.0.0 — 3.3.1+2

Also affects: Debian Linux 11.0, 12.0, 13.0

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
CVEList
FastDDS has heap buffer overflow in readData via Manipulated DATA Submessage when DDS Security is enabled↗2026-02-03
▶
OSV
CVE-2025-62602: Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group )↗2026-02-03
▶

📋Vendor Advisories

1
Debian
CVE-2025-62602: fastdds - Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard...↗2025
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-62602 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶