CVE-2025-64098 in Fast-DDS
Summary
by MITRE • 02/03/2026
Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6.11, when the security mode is enabled, modifying the DATA Submessage within an SPDP packet sent by a publisher causes an Out-Of-Memory (OOM) condition, resulting in remote termination of Fast-DDS. If t he fields of `PID_IDENTITY_TOKEN` or `PID_PERMISSIONS_TOKEN` in the DATA Submessage are tampered with — specifically by ta mpering with the the `vecsize` value read by `readOctetVector` — a 32-bit integer overflow can occur, causing `std::vector ::resize` to request an attacker-controlled size and quickly trigger OOM and remote process termination. Versions 3.4.1, 3 .3.1, and 2.6.11 patch the issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 02/18/2026
Fast DDS represents a significant security vulnerability that exploits memory management flaws within the Data Distribution Service implementation, specifically when security features are enabled. This vulnerability affects multiple version branches including 3.4.0 and below, 3.3.0 and below, and 2.6.10 and below, making it a widespread concern across the Fast DDS ecosystem. The flaw manifests through manipulation of the DATA Submessage within SPDP (Service Participant Discovery Protocol) packets, which are fundamental to the discovery process in DDS networks. The vulnerability operates by targeting the parsing logic that handles token fields, specifically the PID_IDENTITY_TOKEN and PID_PERMISSIONS_TOKEN fields, which contain critical security information for participant authentication and authorization within the DDS domain.
The technical exploitation occurs through a precise manipulation of the vecsize field within the octet vector parsing mechanism. When the readOctetVector function processes the attacker-controlled vecsize value, it triggers a 32-bit integer overflow condition that propagates to the std::vector::resize operation. This overflow results in the vector attempting to allocate an attacker-controlled memory size that far exceeds normal operational parameters, leading to rapid memory exhaustion. The vulnerability leverages the inherent trust in the SPDP packet structure and the security mode's expectation that all participant discovery information remains valid and properly formatted. This design flaw creates a path where malformed data can bypass normal memory allocation limits and cause the target process to terminate remotely, effectively enabling a denial-of-service attack that can be executed from remote locations without requiring authentication or direct system access.
The operational impact of this vulnerability extends beyond simple service disruption, as it represents a critical weakness in the security infrastructure of Fast DDS implementations. Remote attackers can trigger process termination with minimal effort, potentially causing cascading failures in distributed systems that depend on DDS for real-time data exchange. The vulnerability directly impacts the availability and reliability of DDS-based applications, particularly in mission-critical environments such as industrial control systems, automotive networks, and aerospace applications where Fast DDS is commonly deployed. From an attack perspective, this vulnerability aligns with the ATT&CK technique of privilege escalation through resource exhaustion, and the CWE classification of CWE-129, which addresses improper validation of array indices and buffer bounds. The attack surface is particularly concerning because it operates at the protocol level, meaning that any system running Fast DDS with security enabled is vulnerable, regardless of the application layer protections in place.
The patching solution implemented in versions 3.4.1, 3.3.1, and 2.6.11 addresses the root cause by introducing proper bounds checking and validation of the vecsize parameter before it is used in memory allocation operations. These updates ensure that the readOctetVector function properly validates input parameters and prevents integer overflow conditions that could lead to malicious memory allocation requests. Organizations should prioritize immediate patching of all affected Fast DDS installations, particularly those operating in security-sensitive environments where the vulnerability could be exploited to cause service disruption or compromise system availability. The remediation process should include thorough testing of patched versions to ensure that legitimate functionality remains intact while preventing the exploitation vectors identified in the vulnerability analysis. Additionally, system administrators should consider implementing network monitoring to detect anomalous SPDP packet patterns that might indicate attempted exploitation of this vulnerability, as the attack behavior could potentially be detected through unusual memory allocation patterns or process termination events in system logs.