High Severity Vulnerability
This vulnerability has been rated as High severity. Immediate action is recommended.
CVE-2025-62603
HighVulnerability Description
Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group
). ParticipantGenericMessage is the DDS Security control-message container that carries not only the handshake but also on
going security-control traffic after the handshake, such as crypto-token exchange, rekeying, re-authentication, and token
delivery for newly appearing endpoints. On receive, the CDR parser is invoked first and deserializes the `message_data` (i
.e., the `DataHolderSeq`) via the `readParticipantGenericMessage → readDataHolderSeq` path. The `DataHolderSeq` is parsed
sequentially: a sequence count (`uint32`), and for each DataHolder the `class_id` string (e.g. `DDS:Auth:PKI-DH:1.0+Req`),
string properties (a sequence of key/value pairs), and binary properties (a name plus an octet-vector). The parser operat
es at a stateless level and does not know higher-layer state (for example, whether the handshake has already completed), s
o it fully unfolds the structure before distinguishing legitimate from malformed traffic. Because RTPS permits duplicates,
delays, and retransmissions, a receiver must perform at least minimal structural parsing to check identity and sequence n
umbers before discarding or processing a message; the current implementation, however, does not "peek" only at a minimal
header and instead parses the entire `DataHolderSeq`. As a result, prior to versions 3.4.1, 3.3.1, and 2.6.11, this parsi
ng behavior can trigger an out-of-memory condition and remotely terminate the process. Versions 3.4.1, 3.3.1, and 2.6.11 p
atch the issue.
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Known Affected Software
83 configuration(s) from 2 vendor(s)
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:13.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.0.2:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:3.1.1:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.4.2:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.7.1:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.3.3:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.0.6:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.10.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.6.6:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.4.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:3.0.2:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.3.01:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.6.8:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.1.3:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:0.5.2:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.7.2:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.6.5:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.5.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.6.7:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.9.3:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.0.0:-:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.3.5:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:0.5.1:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.6.1:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.6.10:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.6.4:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:3.3.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.0.3:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:0.3.1:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.9.5:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.8.0-2:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.0.1:-:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.10.1:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.3.1:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.1.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.1.2:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:3.1.2:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.5.1:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.8.3:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.1.1:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.9.2:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.8.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.3.2:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:0.5.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:3.0.1:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.2.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.3.0-1:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.7.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.1.4:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.3.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.4.1:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.5.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.6.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:0.3.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.6.3:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.5.2:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:3.4.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.9.0:beta:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.8.4:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.8.2:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.8.5:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.6.2:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.3.6:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.2.1:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.7.3:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.9.1:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:2.3.4:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.6.0:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.9.4:*:*:*:*:*:*:*
cpe:2.3:a:eprosima:fast_dds:1.8.1:*:*:*:*:*:*:*
References & Resources
-
https://github.com/eProsima/Fast-DDS/commit/354218514d32beac963ff5c306f1cf159ee37c5fsecurity-advisories@github.com Patch
-
https://github.com/eProsima/Fast-DDS/commit/a726e6a5daba660418d1f7c05b6f203c17747d2bsecurity-advisories@github.com Patch
-
https://github.com/eProsima/Fast-DDS/commit/ced3b6f92d928af1eae77d5fe889878128ad421asecurity-advisories@github.com Patch
-
https://security-tracker.debian.org/tracker/CVE-2025-62603security-advisories@github.com Third Party Advisory
Severity Details
Weakness Type (CWE)
Out-of-bounds Read
- Description
- The product reads data past the end, or before the beginning, of the intended buffer.
- Typical Severity
- High
- Abstraction Level
- Base
Key Information
- Published Date
- February 03, 2026
