CVE-2023-50716 is a critical memory flaw in eProsima Fast DDS, scored 9.6. An invalid DATA_FRAG submessage causes a bad free that can remotely terminate the process. Upgrade to 2.13.0, 2.12.2, 2.11.3, 2.10.3 or 2.6.7, depending on your release line, and rebuild any images that bundle the library.
What's affected
The GitHub advisory lists Fast DDS v2.12.1 and earlier as affected. The record's description says "prior to versions 2.13.0, 2.12.2, 2.11.3, 2.10.3, and 2.6.7". Patched releases are 2.13.0, 2.12.2, 2.11.3, 2.10.3 and 2.6.7.
There is one inconsistency to note. The record's own description lists 2.10.3 as a version that is vulnerable until, and then 2.10.2 in the sentence naming fixed versions. The advisory says 2.10.3. Use 2.10.3 and check the release notes if you are on the 2.10 line.
NVD scores it 9.6 (Critical) with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The advisory gives the same score and rating. The attack vector is the adjacent network, which suits a DDS participant on the same segment. Note that the description speaks of a process termination, while the vector claims high confidentiality and integrity impact. Plan for the worst case, but know the described behavior is a crash.
The advisory lists no workaround. The reporter's suggested code change is to initialize the payload and inline QoS data pointers to null before an early return in the message receiver. Upgrading is the stated remedy.
How to check if you're exposed
Fast DDS ships inside robotics and automotive stacks, often under another name. Search for the library, formerly Fast RTPS:
dpkg -l | grep -i -E "fastdds|fastrtps"
pip list 2>/dev/null | grep -i fast
On ROS 2 systems, the library arrives as a middleware package, so check the version your distribution installs. Compare with the patched versions above, taking care to match your release line.
Also review which network segments carry DDS traffic. Because the vector is adjacent, systems where untrusted devices share the same network as DDS participants are the most exposed.
What to do now
- Find every system running Fast DDS and note its version and release line.
- Upgrade to the patched release for that line: 2.13.0, 2.12.2, 2.11.3, 2.10.3 or 2.6.7.
- Rebuild container images and robot or vehicle software images that bundle the library.
- Segment DDS traffic so only trusted participants share the network.
- If you cannot upgrade, consult the advisory about applying the code change.
Why it matters
The weakness is use after free, CWE-416, and here it appears as a bad free: the code tries to release memory that was never initialized. The DATA_FRAG handler returns early on an invalid submessage, and the cleanup path then frees members that hold garbage.
DDS is a publish and subscribe protocol used where many devices talk to each other without a central server. A crash in one participant can interrupt a whole system, which matters in robots, vehicles and industrial control.
The record shows no CISA Known Exploited Vulnerabilities listing, and the advisory does not report exploitation in the wild.
Quick check
Why does the score say 9.6 if it is a crash?
The vector lists high confidentiality, integrity and availability impact with a changed scope. The advisory text describes remote termination. Use the score for prioritization.
Which version should I install?
The patched release in your own line: 2.13.0, 2.12.2, 2.11.3, 2.10.3 or 2.6.7.
Sources
Last reviewed: 19 October 2026.
