What’s Vulnerable › Vulnerabilities

CVE-2023-42459: Malformed DATA submessage leads to bad-free error in Fast-DDS

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-10-16 · updated 2026-06-17
• Weakness: CWE-415

Description

Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). In affected versions specific DATA submessages can be sent to a discovery locator which may trigger a free error. This can remotely crash any Fast-DDS process. The call to free() could potentially leave the pointer in the attackers control which could lead to a double free. This issue has been addressed in versions 2.12.0, 2.11.3, 2.10.3, and 2.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

• eProsima Fast-DDS: before 2.6.7; from 2.10.0 before 2.10.3; from 2.11.0 through 2.11.1 — fixed in 2.10.3, 2.6.7

How to fix

Upgrade to a fixed version: eProsima Fast-DDS 2.10.3, 2.6.7. Check the vendor advisory for mitigations.

References

• https://github.com/eProsima/Fast-DDS/issues/3207
• https://github.com/eProsima/Fast-DDS/pull/3824
• https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-gq8g-fj58-22gm
• https://www.debian.org/security/2023/dsa-5568
• https://github.com/eProsima/Fast-DDS/issues/3207
• https://github.com/eProsima/Fast-DDS/pull/3824
• https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-gq8g-fj58-22gm
• https://www.debian.org/security/2023/dsa-5568

Get alerted when CVE-2023-42459 or the next vulnerability affects your stack