CVE-2025-62799
Published: 03 February 2026
Summary
CVE-2025-62799 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Eprosima Fast Dds. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-62799 is a heap buffer overflow vulnerability in the DATA_FRAG receive path of Fast DDS, an open-source C++ implementation of the OMG Data Distribution Service (DDS) standard. The issue affects Fast DDS versions prior to 3.4.1, 3.3.1, and 2.6.11. It stems from a malformed RTPS DATA_FRAG packet where the fragmentSize and sampleSize parameters are crafted to violate internal assumptions, leading to a 4-byte alignment step during fragment metadata initialization that writes past the end of the allocated payload buffer.
An unauthenticated remote attacker can exploit this vulnerability by transmitting a single specially crafted RTPS DATA_FRAG packet to a vulnerable Fast DDS instance. Successful exploitation triggers an immediate crash, resulting in a denial-of-service (DoS) condition, and carries a risk of memory corruption that could enable remote code execution (RCE). The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write).
Mitigation is available through upgrading to Fast DDS versions 3.4.1, 3.3.1, or 2.6.11, which include patches addressing the alignment issue in the DATA_FRAG handling code. Relevant patch commits are published in the eProsima/Fast-DDS GitHub repository, and Debian's security tracker documents the issue for affected packages.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206666
Vulnerability details
Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6.11, a heap buffer overflow exists in the Fast-DDS DATA_FRAG receive path. An un…
more
authenticated sender can transmit a single malformed RTPS DATA_FRAG packet where `fragmentSize` and `sampleSize` are craft ed to violate internal assumptions. Due to a 4-byte alignment step during fragment metadata initialization, the code write s past the end of the allocated payload buffer, causing immediate crash (DoS) and potentially enabling memory corruption ( RCE risk). Versions 3.4.1, 3.3.1, and 2.6.11 patch the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated heap buffer overflow via crafted RTPS DATA_FRAG packets directly enables exploitation of a network-exposed DDS service for DoS or RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 mandates timely remediation of flaws, directly addressing this heap buffer overflow by requiring upgrades to patched Fast DDS versions 3.4.1, 3.3.1, or 2.6.11.
SI-10 requires validation of information inputs like fragmentSize and sampleSize in RTPS DATA_FRAG packets to prevent buffer overflows from malformed data.
SI-16 implements memory protections such as ASLR and DEP to mitigate exploitation of the heap buffer overflow for memory corruption or RCE.