CVE-2023-39945
HighCVSS 8.2Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
In eprosima Fast DDS, prior to versions 2.11.0, 2.10.2, 2.9.2, and 2.6.5, a vulnerability exists that raises an unhandled `BadParamException` in fastcdr, leading to a crash of fastdds.
Risk Assessment
This vulnerability may lead to unexpected system crashes, potentially affecting the availability of services within the organization.
Recommendation
It is recommended to upgrade to versions 2.11.0, 2.10.2, 2.9.2, or 2.6.5, which contain a patch for this issue.
Other vulnerabilities in eprosima Fast DDS
See all- CVE-2025-67108Critical
eProsima Fast-DDS version 3.3 was found to have improper validation for ticket revocation, resulting in insecure communications and connections.
- CVE-2025-65865High
An integer overflow vulnerability in eProsima Fast-DDS version 3.3 allows an attacker to cause a Denial of Service (DoS) by sending crafted input.
- CVE-2023-39949High
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard. Prior to versions 2.9.1 and 2.6.5, improper validation of sequence numbers may lead to remotely reachable assertion failure.
- CVE-2023-39948High
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard. In versions prior to 2.10.0 and 2.6.5, the `BadParamException` thrown by Fast CDR is not caught in Fast DDS, which can remotely crash any Fast DDS process.
- CVE-2023-39947High
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard. In versions prior to 2.11.1, 2.10.2, 2.9.2, and 2.6.6, malformed `PID_PROPERTY_LIST` parameters can cause heap overflow at a different program counter, potentially crashing any Fast-DDS process remotely.
- CVE-2023-39946High
eprosima Fast DDS prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6 is vulnerable to heap overflow caused by the PID_PROPERTY_LIST parameter containing a CDR string longer than the actual content size. This vulnerability can lead to remote crashes of any Fast-DDS process.
- CVE-2023-39534High
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard. In versions prior to 2.10.0, 2.9.2, and 2.6.5, a malformed GAP submessage can trigger assertion failure, crashing FastDDS.
Original NVD description (English source)
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.0, 2.10.2, 2.9.2, and 2.6.5, a data submessage sent to PDP port raises unhandled `BadParamException` in fastcdr, which in turn crashes fastdds. Versions 2.11.0, 2.10.2, 2.9.2, and 2.6.5 contain a patch for this issue.