CVE-2026-22590 in Fast-DDS
Summary
by MITRE • 09/09/2026
eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS `DATA_FRAG` submessages. An attacker can craft a `DATA_FRAG` with a large `sampleSize` but a small actual payload, and set `fragmentsInSubmessage` such that the receiver treats the packet as the LAST fragment**. In this LAST-fragment path, Fast-DDS computes `incoming_length` based on `sampleSize` and calls `memcpy()` without validating `incoming_data.length >= incoming_length`. As a result, `CacheChange_t::add_fragments()` reads past the received UDP datagram buffer and into adjacent heap memory, copying those bytes into the reassembly buffer. In a Discovery Server deployment, the resulting `CacheChange_t` can be relayed to other participants, meaning that a newly joining participant may receive leaked heap memory (e.g., pointer values that could aid ASLR bypass). Versions 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 fix the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The eprosima Fast DDS library serves as a prominent C++ implementation of the Data Distribution Service standard defined by the Object Management Group, facilitating efficient real-time data exchange in distributed systems. A critical security vulnerability has been identified within versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2, specifically affecting the processing of RTPS DATA_FRAG submessages. This flaw represents a remotely triggerable out-of-bounds read condition that arises during the reassembly process of fragmented data packets. The vulnerability stems from an insufficient validation mechanism when handling large sample sizes in conjunction with small actual payloads, allowing attackers to manipulate memory access boundaries and potentially exfiltrate sensitive information from the host system's heap space.
The technical root cause lies in the logic governing the reception and assembly of DATA_FRAG submessages within the RTPS protocol stack. An attacker can craft a malicious packet where the sampleSize field is set to a large value, while the actual payload data remains small. By setting the fragmentsInSubmessage flag such that the receiver interprets this specific packet as the final fragment in a sequence, Fast DDS proceeds with reassembly using incorrect assumptions about data volume. Specifically, the library calculates an incoming_length based on the declared sampleSize rather than verifying it against the actual length of the received UDP datagram buffer. Consequently, when CacheChange_t::add_fragments is invoked to copy this data into the reassembly buffer, a memcpy operation occurs without validating that the source buffer contains at least incoming_length bytes. This lack of bounds checking results in reading past the end of the allocated heap memory associated with the network packet buffer.
The operational impact of this vulnerability extends beyond simple information disclosure due to the architecture of Discovery Server deployments common in DDS networks. When a vulnerable Fast DDS instance processes these malicious fragments, it not only leaks adjacent heap memory into its own reassembly buffers but also propagates this corrupted CacheChange_t object to other connected participants. This means that newly joining nodes or existing peers receiving updates from the compromised node will ingest data containing leaked memory contents. Such leakage can expose pointer values, stack addresses, and other internal state information critical for bypassing Address Space Layout Randomization protections. The ability to leak heap metadata significantly lowers the barrier for subsequent exploitation attempts, potentially leading to remote code execution if combined with additional vulnerability chains or specific memory corruption techniques targeting the reassembled data structures.
This flaw is categorized under CWE-125, which describes Out-of-Bounds Read vulnerabilities where software reads data past the end of a buffer. In terms of offensive security frameworks, this behavior aligns with ATT&CK technique T1074, specifically Data Staged or Local Data Stealing, as it involves exfiltrating sensitive information from local memory resources during normal operational processes. The vulnerability highlights the risks associated with trusting protocol-level size fields without rigorous validation against actual transport-layer data lengths, a common pitfall in high-performance networking libraries that prioritize throughput over strict input sanitization by default.
Mitigation strategies primarily involve upgrading to patched versions of eprosima Fast DDS, specifically version 2.6.12 or later for the 2.x branch, and versions 3.2.4, 3.3.1, or 3.4.2 for their respective branches. These updates implement proper bounds checking before performing memory copy operations during fragment reassembly. For environments where immediate patching is not feasible, network-level controls such as ingress filtering can help mitigate the risk by restricting incoming RTPS traffic to trusted sources only. Additionally, deploying runtime application self-protection mechanisms or using compilers with stack-smashing detection and heap metadata integrity checks may provide some layer of defense against exploitation attempts that rely on the leaked memory information for further attacks.