CVE-2025-62600

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-62600", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-10-16T19:24:37.267Z", "datePublished": "2026-02-03T19:11:19.429Z", "dateUpdated": "2026-04-14T15:39:28.295Z"}, "containers": {"cna": {"title": "eprosima Fast DDS affected by Out-of-Memory in readBinaryPropertySeq via Manipulated DATA Submessage when DDS Security is enabled", "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-789", "lang": "en", "description": "CWE-789: Memory Allocation with Excessive Size Value", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-hvm8-mm7f-m6hc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-hvm8-mm7f-m6hc"}], "affected": [{"vendor": "eProsima", "product": "Fast-DDS", "versions": [{"version": "< 2.6.11", "status": "affected"}, {"version": ">= 2.7.0, < 2.14.6", "status": "affected"}, {"version": ">= 3.0.0, < 3.2.4", "status": "affected"}, {"version": ">= 3.3.0, < 3.3.1", "status": "affected"}, {"version": ">= 3.4.0, < 3.4.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T18:04:15.722Z"}, "descriptions": [{"lang": "en", "value": "eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to 2.6.11, 2.14.6, 3.2.4, 3.3.1, and 3.4.1, when the security mode is enabled, modifying the DATA Submessage within an SPDP packet sent by a publisher causes an Out-Of-Memory (OOM) condition, resulting in remote termination of Fast-DDS.\nIf the fields of PID_IDENTITY_TOKEN or PID_PERMISSION_TOKEN in the DATA Submessage \u2014 specifically by tampering with the length field in readBinaryPropertySeq\u2014 are modified, an integer overflow occurs, leading to an OOM during the resize operation. This vulnerability is fixed in 2.6.11, 2.14.6, 3.2.4, 3.3.1, and 3.4.1."}], "source": {"advisory": "GHSA-hvm8-mm7f-m6hc", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-hvm8-mm7f-m6hc", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-14T15:39:24.495069Z", "id": "CVE-2025-62600", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T15:39:28.295Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-62600", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T15:39:24.495069Z"}}}], "references": [{"url": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-hvm8-mm7f-m6hc", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T19:48:07.605Z"}}], "cna": {"title": "eprosima Fast DDS affected by Out-of-Memory in readBinaryPropertySeq via Manipulated DATA Submessage when DDS Security is enabled", "source": {"advisory": "GHSA-hvm8-mm7f-m6hc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "eProsima", "product": "Fast-DDS", "versions": [{"status": "affected", "version": "< 2.6.11"}, {"status": "affected", "version": ">= 2.7.0, < 2.14.6"}, {"status": "affected", "version": ">= 3.0.0, < 3.2.4"}, {"status": "affected", "version": ">= 3.3.0, < 3.3.1"}, {"status": "affected", "version": ">= 3.4.0, < 3.4.2"}]}], "references": [{"url": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-hvm8-mm7f-m6hc", "name": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-hvm8-mm7f-m6hc", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to 2.6.11, 2.14.6, 3.2.4, 3.3.1, and 3.4.1, when the security mode is enabled, modifying the DATA Submessage within an SPDP packet sent by a publisher causes an Out-Of-Memory (OOM) condition, resulting in remote termination of Fast-DDS.\nIf the fields of PID_IDENTITY_TOKEN or PID_PERMISSION_TOKEN in the DATA Submessage \u2014 specifically by tampering with the length field in readBinaryPropertySeq\u2014 are modified, an integer overflow occurs, leading to an OOM during the resize operation. This vulnerability is fixed in 2.6.11, 2.14.6, 3.2.4, 3.3.1, and 3.4.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190: Integer Overflow or Wraparound"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789: Memory Allocation with Excessive Size Value"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T18:04:15.722Z"}}}, "cveMetadata": {"cveId": "CVE-2025-62600", "state": "PUBLISHED", "dateUpdated": "2026-04-14T15:39:28.295Z", "dateReserved": "2025-10-16T19:24:37.267Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-03T19:11:19.429Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Fast-DDS", "vendor": "eProsima", "versions": [{"status": "affected", "version": "< 2.6.11"}, {"status": "affected", "version": ">= 2.7.0, < 2.14.6"}, {"status": "affected", "version": ">= 3.0.0, < 3.2.4"}, {"status": "affected", "version": ">= 3.3.0, < 3.3.1"}, {"status": "affected", "version": ">= 3.4.0, < 3.4.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*", "matchCriteriaId": "8BAE40E0-6DFF-4878-9438-9C2488C9831C", "versionEndExcluding": "2.6.11", "vulnerable": true}, {"criteria": "cpe:2.3:a:eprosima:fast_dds:*:*:*:*:*:*:*:*", "matchCriteriaId": "94A01F76-524F-4A5B-A782-CC789F229136", "versionEndExcluding": "3.3.1", "versionStartIncluding": "3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:eprosima:fast_dds:3.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "D4452677-95AB-46F9-9B76-9F0B15E62261", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*", "matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:13.0:*:*:*:*:*:*:*", "matchCriteriaId": "204FC6CC-9DAC-45FB-8A9F-C9C8EDD29D54", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to 2.6.11, 2.14.6, 3.2.4, 3.3.1, and 3.4.1, when the security mode is enabled, modifying the DATA Submessage within an SPDP packet sent by a publisher causes an Out-Of-Memory (OOM) condition, resulting in remote termination of Fast-DDS.\nIf the fields of PID_IDENTITY_TOKEN or PID_PERMISSION_TOKEN in the DATA Submessage \u2014 specifically by tampering with the length field in readBinaryPropertySeq\u2014 are modified, an integer overflow occurs, leading to an OOM during the resize operation. This vulnerability is fixed in 2.6.11, 2.14.6, 3.2.4, 3.3.1, and 3.4.1."}, {"lang": "es", "value": "Fast DDS es una implementaci\u00f3n en C++ del est\u00e1ndar DDS (Data Distribution Service) de la OMG (Object Management Group). Antes de las versiones 3.4.1, 3.3.1 y 2.6.11, cuando el modo de seguridad est\u00e1 habilitado, modificar el Submensaje DATA dentro de un paquete SPDP enviado por un publicador causa una condici\u00f3n de falta de memoria (OOM), lo que resulta en la terminaci\u00f3n remota de Fast-DDS. Si los campos de PID_IDENTITY_TOKEN o PID_PERMISSION_TOKEN en el Submensaje DATA \u2014 espec\u00edficamente al manipular el campo de longitud en readBinaryPropertySeq \u2014 son modificados, ocurre un desbordamiento de entero, lo que lleva a una OOM durante la operaci\u00f3n de redimensionamiento. Las versiones 3.4.1, 3.3.1 y 2.6.11 aplican un parche al problema."}], "id": "CVE-2025-62600", "lastModified": "2026-06-17T09:52:08.503", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62600", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T15:39:24.495069Z", "version": "2.0.3"}}]}, "published": "2026-02-03T19:16:14.170", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-hvm8-mm7f-m6hc"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-hvm8-mm7f-m6hc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}, {"lang": "en", "value": "CWE-789"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T16:32:40.570693+00:00", "value": {"mitigation_remediation": ["Upgrade eProsima Fast\u2011DDS to at least 2.6.11, 2.14.6, 3.2.4, 3.3.1, or 3.4.1, or to a newer release that includes the fix.", "If an immediate upgrade is not feasible, disable DDS Security for the affected processes to remove the vulnerable code path.", "Restart affected services after patching to ensure the new binaries are loaded."], "summary": {"action": "Patch Immediately", "impact": "Remote Denial of Service (process termination)"}, "threat_synthesis": {"affected_systems": "The flaw affects eProsima Fast\u2011DDS versions prior to 2.6.11, 2.14.6, 3.2.4, 3.3.1, and 3.4.1. Systems running these libraries on Debian Linux 11, 12, or 13 are impacted when DDS Security is enabled. Any deployment that uses the secure branch of Fast\u2011DDS must verify the version in use.", "description_and_impact": "An integer overflow in eProsima Fast\u2011DDS\u2019s readBinaryPropertySeq function occurs when the length field of a property in the DATA Submessage is tampered with while DDS Security is enabled. This overflow leads to an out\u2011of\u2011memory condition during a resize operation, causing the Fast\u2011DDS process to crash. The result is a remote denial of service that can terminate any Fast\u2011DDS instance receiving the malformed packet, reflecting the weaknesses detailed in CWE\u2011190 and CWE\u2011789.", "risk_and_exploitability": "The CVSS score of 8.6 indicates high severity, while the EPSS score of less than 1% suggests a low probability of real\u2011world exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a publisher able to send a crafted SPDP packet to a target subscriber with security enabled\u2014a scenario plausible in shared or hostile networks such as industrial control or multiplayer gaming environments. The crash is repeatable and reliably triggers a denial\u2011of\u2011service once the conditions are met."}}}}, "created": "2026-02-04T12:05:17.399559+00:00", "updated": "2026-04-20T16:45:11.948570+00:00", "vendors": ["eprosima", "eprosima$PRODUCT$fast_dds"]}