CVE-2025-62601: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-62601 is a heap-based buffer overflow vulnerability in eProsima Fast DDS, a C++ implementation of the OMG Data Distribution Service (DDS) standard. When security mode is enabled, an unauthenticated remote attacker can send a crafted SPDP packet with a tampered DATA Submessage to trigger a 32-bit integer overflow in the readString function (called from readBinaryProperty), causing std::vector::resize to use an attacker-controlled size and resulting in a heap buffer overflow and remote process termination. Affected versions include all releases prior to 3.4.1, 3.3.1, and 2.6.11. It carries a CVSS v3.1 base score of 7.5 (High) (Feedly, Debian Tracker). The vulnerability was published on February 3, 2026.

The root cause is classified as CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write), triggered by a 32-bit integer overflow (CAPEC-92) during deserialization of SPDP discovery packets. Specifically, when security mode is active, the str_size field within PID_IDENTITY_TOKEN or PID_PERMISSIONS_TOKEN parameters of the DATA Submessage is read by readString (called from readBinaryProperty) without adequate bounds checking; a tampered str_size value causes an integer overflow, which then passes an attacker-controlled size to std::vector::resize, overflowing the heap buffer. The fix, applied across three patch commits, completely refactors the CDRMessage built-in deserializers to use 64-bit arithmetic for length checks, introduces a wrap_from_other_message helper to safely bound submessage parsing, and adds overflow guards before any uint32_t cast (GitHub Commit 3542185, GitHub Commit a726e6a, GitHub Commit ced3b6f). No authentication or user interaction is required; the only precondition is that the target Fast DDS instance has security mode enabled and is reachable over the network.

Successful exploitation results in remote termination of the Fast DDS process, causing a denial of service (DoS) for any application or system relying on Fast DDS for data distribution. There is no evidence of confidentiality or integrity impact — the vulnerability is purely an availability issue. In robotics, industrial automation, or other real-time systems that depend on DDS for inter-process communication, crashing the Fast DDS middleware can disrupt critical data flows and cause cascading failures across dependent services (Feedly, Debian Tracker).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.01% (0.000100), indicating a very low probability of exploitation in the near term. The attack requires no authentication, no user interaction, and is network-accessible, but the requirement for security mode to be enabled limits the exposed attack surface.

1. Reconnaissance: Identify Fast DDS instances with security mode enabled on the target network using network scanning tools (e.g., Nmap) targeting RTPS/DDS discovery ports (typically UDP 7400–7500 range).
2. Craft malicious SPDP packet: Construct a valid SPDP (Simple Participant Discovery Protocol) packet containing a DATA Submessage with PID_IDENTITY_TOKEN or PID_PERMISSIONS_TOKEN parameter.
3. Tamper with str_size: Within the readBinaryProperty parsing path, set the str_size field to a value that, when processed as a 32-bit integer, causes an overflow — for example, a value near 0xFFFFFFFF that wraps around when added to other length values.
4. Send the packet: Transmit the crafted UDP packet to the target Fast DDS participant's SPDP multicast or unicast address.
5. Trigger heap buffer overflow: The vulnerable readString function passes the overflowed size to std::vector::resize, allocating an incorrect buffer size and triggering a heap buffer overflow, which crashes the Fast DDS process (GitHub Commit 3542185, Feedly).

• Network: Unexpected or malformed UDP packets targeting RTPS discovery ports (7400–7500) from unknown sources; SPDP packets with anomalously large str_size values in PID_IDENTITY_TOKEN or PID_PERMISSIONS_TOKEN fields.
• Process: Sudden, unexpected termination of Fast DDS participant processes; crash dumps or core files generated by the Fast DDS process.
• Logs: Application logs showing Fast DDS process crashes or restarts; operating system logs (e.g., dmesg, journalctl) recording segmentation faults or heap corruption errors in the Fast DDS binary.
• File System: Presence of core dump files (e.g., core.*) in the working directory of the Fast DDS process following unexpected termination.

Upgrade Fast DDS to patched versions 3.4.1, 3.3.1, or 2.6.11 (or later within each respective version track), which completely refactor the CDRMessage deserializers to prevent arithmetic overflows (GitHub Commit 3542185, GitHub Commit a726e6a, GitHub Commit ced3b6f). If immediate patching is not possible, restrict network access to SPDP communication endpoints using firewall rules or network segmentation, and ensure only trusted publishers can communicate with Fast DDS instances in security-enabled mode. Note that Debian packages across bullseye, bookworm, trixie, and sid remain unfixed as of the advisory date (Debian Tracker).

Red Hat has published a security advisory tracking this CVE (Red Hat Advisory). Debian's security tracker has classified the issue as a "Minor issue" for stable releases (bullseye, bookworm, trixie), indicating lower remediation urgency in those branches (Debian Tracker). No significant broader media coverage or notable researcher commentary beyond standard vulnerability database entries has been identified.