CVE-2025-64098

CWE-125 — Out-of-bounds ReadCWE-190 — Integer Overflow5 documents5 sources
Severity
1.7LOW
EPSS
0.0%
top 94.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Eprosima Fast-ddsEprosima Fast DDSDebian Debian Linux
Timeline
PublishedFeb 3

Description

Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6.11, when the security mode is enabled, modifying the DATA Submessage within an SPDP packet sent by a publisher causes an Out-Of-Memory (OOM) condition, resulting in remote termination of Fast-DDS. If t he fields of `PID_IDENTITY_TOKEN` or `PID_PERMISSIONS_TOKEN` in the DATA Submessage are tampered with — specifically by ta mpering with th…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5eprosima/fast-dds3.4.0 — 3.4.1+2
▶NVDeprosima/fast_dds3.0.0 — 3.3.1+2

Also affects: Debian Linux 11.0, 12.0, 13.0

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
OSV
CVE-2025-64098: Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group )↗2026-02-03
▶
CVEList
FastDDS has Out-of-memory in readOctetVector via Manipulated DATA Submessage when DDS Security is enabled↗2026-02-03
▶

📋Vendor Advisories

1
Debian
CVE-2025-64098: fastdds - Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard...↗2025
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-64098 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶