CVE-2025-62600: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-62600 is an integer overflow and out-of-memory (OOM) vulnerability in eprosima Fast DDS, a C++ implementation of the DDS (Data Distribution Service) standard. When security mode is enabled, a remote attacker can craft a malicious SPDP (Simple Participant Discovery Protocol) DATA submessage that tampers with the length field in readBinaryPropertySeq for PID_IDENTITY_TOKEN or PID_PERMISSION_TOKEN parameters, triggering an integer overflow that leads to an unbounded memory allocation and process termination. Affected versions include all releases prior to 2.6.11, 2.14.6, 3.2.4, 3.3.1, and 3.4.1; Debian Linux 11, 12, and 13 package versions are also affected. The vulnerability was published on February 3, 2026, with patches released on April 9, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is an integer overflow (CWE-190) in the readBinaryPropertySeq function combined with memory allocation with an excessive size value (CWE-789) and an out-of-bounds read (CWE-125). The vulnerable code reads an attacker-controlled 32-bit length value from the message and performs a bounds check using 12 * length > parameter_length in 32-bit arithmetic — a crafted value such as 0xc0000000 causes 12 * length to wrap around to 0, bypassing the check entirely. The code then immediately calls binary_properties.resize(length), attempting to allocate approximately 3 GB of memory (0xc0000000 elements), which causes an OOM condition and process termination before any per-element validation occurs. The attack is exploitable via the SPDP discovery path (UDPChannelResource → ReceiverResource → MessageReceiver → PDPListener → ParticipantProxyData → readBinaryPropertySeq) because SPDP packets are processed prior to trust establishment, meaning no authentication is required (GitHub Advisory, Patch Commit).

Successful exploitation results in remote denial of service (DoS) — the targeted Fast DDS process is terminated due to an OOM condition. There is no confidentiality or integrity impact; the vulnerability exclusively affects availability. Any Fast DDS deployment with security mode enabled and network-accessible SPDP ports is at risk, including robotics, industrial automation, and autonomous systems using ROS 2 or similar DDS-based middleware (GitHub Advisory, Red Hat CVE).

1. Reconnaissance: Identify Fast DDS instances with security mode enabled on the network. SPDP discovery uses UDP multicast on port 7400 (239.255.0.1) by default; scan for hosts listening on this port or participating in DDS discovery traffic.
2. Craft malicious SPDP packet: Construct a valid RTPS SPDP DATA submessage that includes a PID_IDENTITY_TOKEN or PID_PERMISSION_TOKEN parameter. Within the token's binary property sequence, set the 4-byte length field (read by readUInt32 in readBinaryPropertySeq) to a value such as 0xc0000000.
3. Trigger integer overflow: The crafted length value causes 12 * 0xc0000000 to overflow to 0 in 32-bit arithmetic, bypassing the bounds check if (12 * length > parameter_length).
4. Send the packet: Using a tool like Scapy, send the crafted UDP packet to the SPDP multicast address and port: sock.sendto(payload, ("239.255.0.1", 7400)). The packet can also be sent unicast to a known Fast DDS participant's address.
5. Achieve DoS: The target Fast DDS process calls binary_properties.resize(0xc0000000), attempting to allocate ~3 GB of memory, resulting in an OOM condition and immediate process termination (GitHub Advisory).

• Network: Unexpected UDP packets to port 7400 (239.255.0.1 multicast or unicast) containing RTPS SPDP DATA submessages with anomalously large PID_IDENTITY_TOKEN or PID_PERMISSION_TOKEN parameter lengths (e.g., values near 0xc0000000).
• Network: Unusual sources sending SPDP discovery traffic that are not known DDS participants in the environment.
• Logs: Sudden, unexplained termination of Fast DDS processes or services; OOM-related kernel messages (Out of memory: Kill process) in system logs (/var/log/syslog, dmesg) coinciding with DDS traffic.
• Process: Fast DDS subscriber or participant processes crashing repeatedly without application-level errors; AddressSanitizer reports referencing readBinaryPropertySeq or CDRMessage::readDataHolder if debug builds are in use.
• File System: Core dump files generated by Fast DDS processes at the time of exploitation attempts (GitHub Advisory).

Upgrade Fast DDS to one of the patched versions: 2.6.11, 2.14.6, 3.2.4, 3.3.1, or 3.4.1. The fix completely refactors the built-in CDRMessage deserializers to use 64-bit arithmetic for length checks, preventing integer overflow, and introduces a wrap_from_other_message helper to safely bound submessage parsing. If immediate patching is not possible, disable security mode in Fast DDS if operationally feasible, as the vulnerability only exists when security mode is enabled. Additionally, implement network segmentation and access controls to restrict SPDP multicast traffic (UDP port 7400) to trusted participants only, and monitor Fast DDS instances for unexpected process terminations or OOM errors (GitHub Advisory, Patch Commit, Debian Tracker).

The vulnerability was reported by researchers identified as r0s4ngeles (reporter), yh-habosol (finder), and analysts chrmqgozj, Cloud-96, and d3l-v, with the advisory published by eProsima maintainer MiguelCompany on April 9, 2026. Red Hat has acknowledged the vulnerability and published a CVE tracking page. Debian has classified the issue as a minor severity for stable releases (bullseye, bookworm, trixie) with no immediate fix backported to stable at the time of disclosure. No significant broader media coverage or social media discussion has been identified beyond standard vulnerability tracking (GitHub Advisory, Red Hat CVE, Debian Tracker).