CVE-2024-30259
FastDDS heap buffer overflow when publisher sends malformed packet
HIGH 7.5EPSS 0.9%
FastDDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8, when a publisher serves malformed `RTPS` packet, heap buffer overflow occurs on the subscriber. This can remotely crash any Fast-DDS process, potentially leading to a DOS attack. Versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8 contain a patch for the issue.
- Affected
- eProsima · Fast-DDS
- CVSS v3.1 NVD
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS v3.1 GITHUB
- 8.2 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - EPSS
- 0.87% chance of exploitation in the next 30 days, 58th percentile
- Published
- 2024-05-13
- Updated
- 2024-08-02