CVE-2025-62599: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-62599 is an integer overflow and Out-of-Memory (OOM) denial-of-service vulnerability in eProsima Fast DDS, a C++ implementation of the DDS (Data Distribution Service) standard. When security mode is enabled, an unauthenticated remote attacker can craft a malicious SPDP packet with a tampered length field in the readPropertySeq function (targeting PID_IDENTITY_TOKEN or PID_PERMISSION_TOKEN fields), triggering an integer overflow that causes an excessive memory allocation and remote process termination. Affected versions include Fast DDS prior to 2.6.11, 2.14.6, 3.2.4, 3.3.1, and 3.4.1, as well as Debian Linux 11.0, 12.0, and 13.0 (where the fastdds package remains unfixed in stable releases). It was published on February 3, 2026, with a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is an integer overflow (CWE-190) combined with memory allocation with an excessive size value (CWE-789) in the CDRMessage::readPropertySeq function. The function reads an attacker-controlled 32-bit length value from the message and performs a bounds check using 16 * length > parameter_length; however, this multiplication is performed in 32-bit arithmetic, so large values (e.g., 0x10000000) wrap around to zero, bypassing the check entirely. Immediately after the flawed check, std::vector::resize(length) is called, attempting to allocate memory for up to 0x10000000 elements, which exhausts system memory and terminates the process. The vulnerability is exploitable via the SPDP (Simple Participant Discovery Protocol) multicast channel (UDP port 7400), which is processed before any authentication is established, meaning no credentials are required (GitHub Advisory, GitHub Commit).

Successful exploitation results in remote termination of the Fast DDS process via an OOM condition, constituting a complete denial-of-service attack with high availability impact and no confidentiality or integrity impact. The attack requires no authentication, no user interaction, and no special privileges, making it trivially executable by any network-adjacent attacker who can send UDP packets to the SPDP multicast address. In mission-critical deployments — such as robotics (ROS 2), industrial control systems, or autonomous vehicles that rely on DDS for real-time communication — this can cause severe operational disruption (GitHub Advisory, Red Hat CVE).

A proof-of-concept exploit (Scapy-based UDP packet) is publicly documented in the GitHub security advisory, demonstrating that sending a single crafted SPDP packet to the multicast address 239.255.0.1:7400 is sufficient to crash a vulnerable Fast DDS subscriber process (exit code 137, killed by the OOM killer). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.042% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify network-accessible Fast DDS nodes with security mode enabled by scanning for UDP traffic on port 7400 (SPDP multicast) or by observing DDS discovery traffic on the local network segment.
2. Craft malicious SPDP packet: Construct a UDP packet targeting the SPDP multicast address 239.255.0.1:7400. The packet must be a valid RTPS DATA submessage containing a PID_IDENTITY_TOKEN or PID_PERMISSION_TOKEN parameter with a tampered parameterData field.
3. Inject overflow value: Within the token's property sequence, set the 4-byte integer read by readUInt32 in readPropertySeq to a large value such as 0x10000000 (e.g., bytes 00 00 00 10 in big-endian). This causes 16 * 0x10000000 to overflow to zero in 32-bit arithmetic, bypassing the bounds check.
4. Send the packet: Use a tool such as Scapy (sock.sendto(payload, ('239.255.0.1', 7400))) to transmit the crafted packet. No authentication or prior session establishment is required.
5. Trigger OOM and process termination: The vulnerable properties.resize(0x10000000) call attempts to allocate ~4 billion elements, exhausting system memory. The Linux OOM killer terminates the Fast DDS process (exit code 137) (GitHub Advisory).

• Network: Unexpected UDP packets sent to multicast address 239.255.0.1 on port 7400 from unknown or external sources; RTPS DATA submessages with anomalously large PID_IDENTITY_TOKEN or PID_PERMISSION_TOKEN parameter lengths.
• Logs: System OOM killer log entries (e.g., kernel: Out of memory: Kill process <pid> (FastDDS) score <N>) in /var/log/syslog or dmesg; Fast DDS process exiting with code 137.
• Process: Sudden termination of Fast DDS subscriber or publisher processes without a graceful shutdown; repeated restarts of DDS-dependent services (e.g., ROS 2 nodes).
• File System: Core dump files generated by the Fast DDS process if core dumps are enabled, potentially in /var/crash/ or the working directory of the DDS application (GitHub Advisory).

Upgrade Fast DDS to one of the patched versions: 2.6.11, 2.14.6, 3.2.4, 3.3.1, or 3.4.1. The fix completely refactors the CDRMessage built-in deserializers to use 64-bit arithmetic for length checks, preventing integer overflow, and introduces a wrap_from_other_message helper to safely bound submessage parsing. For systems that cannot be patched immediately: implement network segmentation to restrict SPDP multicast traffic (UDP port 7400) to trusted network segments only; consider disabling DDS security mode if it is not operationally required (though this reduces the security posture); and monitor for unexpected OOM events in DDS processes. Debian packages remain unfixed in stable releases (bullseye, bookworm, trixie) and are tracked under Debian Bug #1121094 (GitHub Advisory, Debian Tracker, GitHub Commit).

The vulnerability was reported by security researchers identified as r0s4ngeles (reporter), chrmqgozj and d3l-v (analysts), Cloud-96 (analyst), and yh-habosol (finder), and was privately reviewed before public disclosure. Red Hat has acknowledged the vulnerability and assigned it a tracking entry. No significant broader media coverage or social media discussion has been observed beyond standard vulnerability database aggregation (GitHub Advisory, Red Hat CVE).