CVE-2025-63548
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2025-63548 is a high-severity Improper Handling of Unexpected Data Type (CWE-241) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-63548 is a denial-of-service vulnerability affecting Eprosima Micro-XRCE-DDS Agent version 3.0.1. The issue arises when the agent processes a specially crafted packet containing a non-valid value in any Boolean field, leading to a crash or service disruption. It has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-241.
A remote attacker can exploit this vulnerability without authentication or user interaction by sending a malicious packet over the network. Successful exploitation results in high-impact availability disruption, such as denial of service against the affected agent, with low attack complexity required.
Mitigation details and further discussion are available in the referenced advisories, including the GitHub issue at https://github.com/eProsima/Micro-XRCE-DDS-Agent/issues/389 and a CVE listing at https://github.com/j4kb4dw0lf/CVEs/blob/main/README.md.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209606
Vulnerability Data
An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a denial of service via a packet specially crafted to bear a non-valid value in any Boolean field.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation explicitly checks that supplied data matches expected types and rejects mismatches before they reach processing logic.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input validation and type checking to prevent this weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect type-handling flaws but does not itself implement the preventive control.
Secure development lifecycle includes input validation and type checking that directly mitigates improper handling of unexpected data types.
Application security requirements typically mandate strong input validation and type enforcement to prevent malformed data processing.
Secure system architecture principles encourage robust input handling but do not specifically address data-type validation.
Secure coding standards explicitly require type checking and input sanitization, directly addressing improper handling of unexpected data types.