CVE-2025-62601

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-62601

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

F

ast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6.11, when the security mode is enabled, modifying the DATA Submessage within an SPDP packet sent by a publisher causes a heap buffer overflow, resulting in remote termination of Fast-DDS. If the fields of `PID_IDENTITY_TOKEN` or `PID_PERMISSIONS_TOKEN` in the DATA Submessage — specifically by tampering with the `str_size` value read by `readString` (called from `readBinaryProperty`) — are modified, a 32-bit integer overflow can occur, causing `std::vector::resize` to use an attacker-controlled size and quickly trigger heap buffer overflow and remote process term ination. Versions 3.4.1, 3.3.1, and 2.6.11 patch the issue.

References
Link Resource
https://github.com/eProsima/Fast-DDS/commit/354218514d32beac963ff5c306f1cf159ee37c5f Patch
https://github.com/eProsima/Fast-DDS/commit/a726e6a5daba660418d1f7c05b6f203c17747d2b Patch
https://github.com/eProsima/Fast-DDS/commit/ced3b6f92d928af1eae77d5fe889878128ad421a Patch
https://security-tracker.debian.org/tracker/CVE-2025-62601 Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:3.4.0:*:*:*:*:*:*:*
History

18 Feb 2026, 16:12

Type Values Removed Values Added
CPE cpe:2.3:a:eprosima:fast_dds:3.4.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*
First Time Eprosima fast Dds
Eprosima
References () https://github.com/eProsima/Fast-DDS/commit/354218514d32beac963ff5c306f1cf159ee37c5f - () https://github.com/eProsima/Fast-DDS/commit/354218514d32beac963ff5c306f1cf159ee37c5f - Patch
References () https://github.com/eProsima/Fast-DDS/commit/a726e6a5daba660418d1f7c05b6f203c17747d2b - () https://github.com/eProsima/Fast-DDS/commit/a726e6a5daba660418d1f7c05b6f203c17747d2b - Patch
References () https://github.com/eProsima/Fast-DDS/commit/ced3b6f92d928af1eae77d5fe889878128ad421a - () https://github.com/eProsima/Fast-DDS/commit/ced3b6f92d928af1eae77d5fe889878128ad421a - Patch
References () https://security-tracker.debian.org/tracker/CVE-2025-62601 - () https://security-tracker.debian.org/tracker/CVE-2025-62601 - Third Party Advisory
Summary
  • (es) Fast DDS es una implementación en C++ del estándar DDS (Data Distribution Service) de la OMG (Object Management Group). Antes de las versiones 3.4.1, 3.3.1 y 2.6.11, cuando el modo de seguridad está habilitado, la modificación del Submensaje DATA dentro de un paquete SPDP enviado por un publicador provoca un desbordamiento de búfer de pila, lo que resulta en la terminación remota de Fast-DDS. Si los campos de 'PID_IDENTITY_TOKEN' o 'PID_PERMISSIONS_TOKEN' en el Submensaje DATA — específicamente al manipular el valor 'str_size' leído por 'readString' (llamado desde 'readBinaryProperty') — son modificados, puede ocurrir un desbordamiento de entero de 32 bits, haciendo que 'std::vector::resize' utilice un tamaño controlado por el atacante y desencadene rápidamente un desbordamiento de búfer de pila y la terminación remota del proceso. Las versiones 3.4.1, 3.3.1 y 2.6.11 corrigen el problema.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CWE CWE-787

03 Feb 2026, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-03 20:15

Updated : 2026-02-18 16:12

NVD link : CVE-2025-62601

Mitre link : CVE-2025-62601

CVE.ORG link : CVE-2025-62601

JSON object : View

Products Affected

eprosima

CWE
CWE-122

Heap-based Buffer Overflow

CWE-787

Out-of-bounds Write