CVE-2023-37915
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
OpenDDS, an open-source C++ implementation of the Data Distribution Service (DDS), crashes while parsing a malformed PID_PROPERTY_LIST in a DATA submessage during participant discovery. Attackers can remotely crash OpenDDS processes by sending a DATA submessage containing the malformed parameter to the known multicast port.
Risk Assessment
This vulnerability may lead to remote denial of service for OpenDDS, impacting the availability of applications relying on this technology. Organizations should be aware of the risks associated with outdated software versions.
Recommendation
It is recommended to upgrade to version 3.25, where the issue has been addressed. There are no known workarounds for this vulnerability.
Other vulnerabilities in OpenDDS
See all- CVE-2026-52836High
In OpenDDS prior to 3.34.0, a network attacker can send a malformed RTPS UDP submessage that causes the read pointer to advance beyond valid data. This results in a SIGSEGV in the receive thread and termination of the DDS process. No authentication or user interaction is required.
- CVE-2026-52486Medium
An issue in OpenDDS 3.33.x allows a local attacker to cause a denial of service via the verify function in the SIgnedDocument module.
Original NVD description (English source)
OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). OpenDDS crashes while parsing a malformed `PID_PROPERTY_LIST` in a DATA submessage during participant discovery. Attackers can remotely crash OpenDDS processes by sending a DATA submessage containing the malformed parameter to the known multicast port. This issue has been addressed in version 3.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.