Fast-DDS Discovery Server: Out-of-Bounds Read & Heap Memory Disclosure via DATA_FRAG  sampleSize / fragmentsInSubmessage

Summary

eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS `DATA_FRAG` submessages. An attacker can craft a `DATA_FRAG` with a large `sampleSize` but a small actual payload, and set `fragmentsInSubmessage` such that the receiver treats the packet as the LAST fragment**. In this LAST-fragment path, Fast-DDS computes `incoming_length` based on `sampleSize` and calls `memcpy()` without validating `incoming_data.length >= incoming_length`. As a result, `CacheChange_t::add_fragments()` reads past the received UDP datagram buffer and into adjacent heap memory, copying those bytes into the reassembly buffer. In a Discovery Server deployment, the resulting `CacheChange_t` can be relayed to other participants, meaning that a newly joining participant may receive leaked heap memory (e.g., pointer values that could aid ASLR bypass). Versions 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 fix the issue.

Timeline

1. Sep 9, 2026, 3:43 PM UTCCVE published
2. Sep 9, 2026, 4:08 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: yes · Technical impact: partial

3. Sep 9, 2026, 4:08 PM UTCRecord last updated

Affected versions

• eProsima Fast-DDS

  fixed in 2.6.12; From 2.7.0 · fixed in 2.14.6; From 3.0.0 · fixed in 3.2.4; From 3.3.0 · fixed in 3.3.1; From 3.4.0 · fixed in 3.4.2

References 1