CVE-2023-39947
HighCVSS 8.2Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard. In versions prior to 2.11.1, 2.10.2, 2.9.2, and 2.6.6, malformed `PID_PROPERTY_LIST` parameters can cause heap overflow at a different program counter, potentially crashing any Fast-DDS process remotely.
Risk Assessment
Organizations using vulnerable versions of Fast DDS may experience remote crashes of processes, leading to service interruptions and potential data loss.
Recommendation
It is recommended to upgrade to versions 2.11.1, 2.10.2, 2.9.2, or 2.6.6, which contain a patch for this issue.
Other vulnerabilities in eprosima Fast DDS
See all- CVE-2025-67108Critical
eProsima Fast-DDS version 3.3 was found to have improper validation for ticket revocation, resulting in insecure communications and connections.
- CVE-2025-65865High
An integer overflow vulnerability in eProsima Fast-DDS version 3.3 allows an attacker to cause a Denial of Service (DoS) by sending crafted input.
- CVE-2023-39949High
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard. Prior to versions 2.9.1 and 2.6.5, improper validation of sequence numbers may lead to remotely reachable assertion failure.
- CVE-2023-39948High
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard. In versions prior to 2.10.0 and 2.6.5, the `BadParamException` thrown by Fast CDR is not caught in Fast DDS, which can remotely crash any Fast DDS process.
- CVE-2023-39946High
eprosima Fast DDS prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6 is vulnerable to heap overflow caused by the PID_PROPERTY_LIST parameter containing a CDR string longer than the actual content size. This vulnerability can lead to remote crashes of any Fast-DDS process.
- CVE-2023-39945High
In eprosima Fast DDS, prior to versions 2.11.0, 2.10.2, 2.9.2, and 2.6.5, a vulnerability exists that raises an unhandled `BadParamException` in fastcdr, leading to a crash of fastdds.
- CVE-2023-39534High
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard. In versions prior to 2.10.0, 2.9.2, and 2.6.5, a malformed GAP submessage can trigger assertion failure, crashing FastDDS.
Original NVD description (English source)
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6, even after the fix at commit 3492270, malformed `PID_PROPERTY_LIST` parameters cause heap overflow at a different program counter. This can remotely crash any Fast-DDS process. Versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6 contain a patch for this issue.