CVE-2025-62799 is a critical heap buffer overflow in eProsima Fast DDS, scored CVSS 9.8. One malformed RTPS DATA_FRAG packet from an unauthenticated sender can crash the process and may corrupt memory. Fixed versions are 3.4.1, 3.3.1 and 2.6.11.
What's affected
The NVD record says Fast DDS versions before 3.4.1, 3.3.1 and 2.6.11 are affected, so the fixed releases are 3.4.1 on the 3.4 line, 3.3.1 on the 3.3 line and 2.6.11 on the 2.6 line. The record also lists Debian Linux, and a Debian security tracker entry exists for the CVE. Check your distribution's tracker for the package version that carries the fix.
The flaw is in the receive path for fragmented data. According to the record, the sender provides a fragment size and a sample size crafted to break assumptions in the code. A 4-byte alignment step during fragment metadata setup then writes past the end of the payload buffer. The result is an immediate crash and possibly memory corruption.
Fast DDS is a C++ implementation of the Data Distribution Service standard. Software that uses it can include it indirectly, so you may be affected without having chosen it.
How to check if you're exposed
Start with what you have installed.
dpkg -l | grep -i -E "fastdds|fastrtps"
ldconfig -p | grep -i -E "fastdds|fastrtps"
Package names vary by distribution and by how your software was built, so the grep is deliberately broad. If your application vendors Fast DDS as source or ships its own copy in a container image, search the image and your build files for the library and read its version.
Compare the version with 2.6.11, 3.3.1 or 3.4.1 for your line. A 2.6.x build below 2.6.11 is in scope, a 3.3.x build below 3.3.1 is in scope, and a 3.4.x build below 3.4.1 is in scope.
Then look at where DDS traffic can arrive. The attacker needs to be able to send RTPS packets to the participant, which usually means being on the same network segment or reaching the UDP ports. Check whether those ports are reachable from outside the segment where your nodes are meant to talk.
What to do now
- List every host, container image and device that includes Fast DDS, directly or through another package.
- Upgrade to 2.6.11, 3.3.1 or 3.4.1 or later, matching your release line.
- On Debian based systems, update through the distribution package once the tracker shows a fixed version, and check the tracker for your release.
- Rebuild container images that bundle the library and redeploy them.
- Limit RTPS and discovery traffic to the segment where participants live, using firewall rules or network policy.
- Add alerting for unexplained crashes of DDS participants, since the immediate effect of this flaw is a crash.
- Scan images before release. A gate on image scan results catches an old library before it ships.
Why it matters
The weaknesses are CWE-122, a heap based buffer overflow, and CWE-787, an out of bounds write. The code computed how much room a fragmented message needs, but the math did not hold for unusual fragment and sample sizes. A final alignment step then pushed a write beyond the end of the allocated buffer.
The fix commit adds a function that calculates the minimum payload size needed for a fragmented change and refuses values that would overflow. It caps the maximum payload size, requires a fragment size of at least four bytes to hold the index, and rounds the last fragment safely. The pattern is typical for this class: arithmetic on lengths that arrive from the network needs bounds checks before any allocation or write.
The score is critical because the sender needs no credentials and one packet is enough to crash the receiver. Robotics, automotive and industrial systems use DDS to connect parts that must keep running, so even a denial of service has real effects. The record says memory corruption is possible, but I found no statement of code execution in what I read, and the KEV flag is false.
If a single image scan across your fleet is too heavy, start with the systems that listen on DDS ports. Reachability information, such as whether your code calls the vulnerable receive path at all, helps you order the work, though for a network facing parser the safe assumption is that it is reachable.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need to log in?
No. The record says an unauthenticated sender can trigger the overflow with one malformed packet, if it can reach the participant.
What is the immediate effect?
An immediate crash, which is a denial of service. The record says memory corruption may also be possible.
Sources
Last reviewed: 19 October 2026.
