CVE-2023-39534
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard. In versions prior to 2.10.0, 2.9.2, and 2.6.5, a malformed GAP submessage can trigger assertion failure, crashing FastDDS.
Risk Assessment
The crash of FastDDS may lead to service interruptions for applications relying on this technology, affecting system availability within the organization.
Recommendation
It is recommended to upgrade to versions 2.10.0, 2.9.2, or 2.6.5, which contain a patch for this issue.
Other vulnerabilities in eprosima Fast DDS
See all- CVE-2025-67108Critical
eProsima Fast-DDS version 3.3 was found to have improper validation for ticket revocation, resulting in insecure communications and connections.
- CVE-2025-65865High
An integer overflow vulnerability in eProsima Fast-DDS version 3.3 allows an attacker to cause a Denial of Service (DoS) by sending crafted input.
- CVE-2023-39949High
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard. Prior to versions 2.9.1 and 2.6.5, improper validation of sequence numbers may lead to remotely reachable assertion failure.
- CVE-2023-39948High
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard. In versions prior to 2.10.0 and 2.6.5, the `BadParamException` thrown by Fast CDR is not caught in Fast DDS, which can remotely crash any Fast DDS process.
- CVE-2023-39947High
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard. In versions prior to 2.11.1, 2.10.2, 2.9.2, and 2.6.6, malformed `PID_PROPERTY_LIST` parameters can cause heap overflow at a different program counter, potentially crashing any Fast-DDS process remotely.
- CVE-2023-39946High
eprosima Fast DDS prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6 is vulnerable to heap overflow caused by the PID_PROPERTY_LIST parameter containing a CDR string longer than the actual content size. This vulnerability can lead to remote crashes of any Fast-DDS process.
- CVE-2023-39945High
In eprosima Fast DDS, prior to versions 2.11.0, 2.10.2, 2.9.2, and 2.6.5, a vulnerability exists that raises an unhandled `BadParamException` in fastcdr, leading to a crash of fastdds.
Original NVD description (English source)
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0, 2.9.2, and 2.6.5, a malformed GAP submessage can trigger assertion failure, crashing FastDDS. Version 2.10.0, 2.9.2, and 2.6.5 contain a patch for this issue.