CVE-2025-65865
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
An integer overflow vulnerability in eProsima Fast-DDS version 3.3 allows an attacker to cause a Denial of Service (DoS) by sending crafted input.
Risk Assessment
An attacker can remotely crash systems or applications using Fast-DDS, leading to service disruption and potential financial losses.
Recommendation
Immediately update eProsima Fast-DDS to the latest available version that includes a fix for the integer overflow vulnerability.
Other vulnerabilities in eProsima Fast-DDS
See all- CVE-2025-67108Critical
eProsima Fast-DDS version 3.3 was found to have improper validation for ticket revocation, resulting in insecure communications and connections.
- CVE-2023-39949High
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard. Prior to versions 2.9.1 and 2.6.5, improper validation of sequence numbers may lead to remotely reachable assertion failure.
- CVE-2023-39948High
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard. In versions prior to 2.10.0 and 2.6.5, the `BadParamException` thrown by Fast CDR is not caught in Fast DDS, which can remotely crash any Fast DDS process.
- CVE-2023-39947High
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard. In versions prior to 2.11.1, 2.10.2, 2.9.2, and 2.6.6, malformed `PID_PROPERTY_LIST` parameters can cause heap overflow at a different program counter, potentially crashing any Fast-DDS process remotely.
- CVE-2023-39946High
eprosima Fast DDS prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6 is vulnerable to heap overflow caused by the PID_PROPERTY_LIST parameter containing a CDR string longer than the actual content size. This vulnerability can lead to remote crashes of any Fast-DDS process.
- CVE-2023-39945High
In eprosima Fast DDS, prior to versions 2.11.0, 2.10.2, 2.9.2, and 2.6.5, a vulnerability exists that raises an unhandled `BadParamException` in fastcdr, leading to a crash of fastdds.
- CVE-2023-39534High
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard. In versions prior to 2.10.0, 2.9.2, and 2.6.5, a malformed GAP submessage can trigger assertion failure, crashing FastDDS.
Original NVD description (English source)
An integer overflow in eProsima Fast-DDS v3.3 allows attackers to cause a Denial of Service (DoS) via a crafted input.