CVE-2025-62602: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-62602 is a heap-based buffer overflow vulnerability in eProsima Fast DDS, a C++ implementation of the OMG Data Distribution Service (DDS) standard. When security mode is enabled, a remote attacker can craft a malicious SPDP packet with tampered PID_IDENTITY_TOKEN or PID_PERMISSIONS_TOKEN fields in the DATA Submessage to trigger a 32-bit integer overflow, leading to out-of-memory conditions and remote process termination. Affected versions include all Fast DDS releases prior to 2.6.11, versions 3.0.0 through 3.3.0, and version 3.4.0; fixed versions are 2.6.11, 3.3.1, and 3.4.1. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Feedly, Debian Security Tracker). It was published on February 3, 2026.

The root cause is classified as CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write), stemming from insufficient input validation in the CDRMessage deserialization routines. Specifically, the readOctetVector function reads an attacker-controlled vecsize field from the SPDP DATA Submessage without bounds checking, and propagates it unchanged as the length parameter into readData. This unchecked value can trigger a 32-bit integer overflow during length calculation, causing an extremely large heap allocation attempt that rapidly exhausts available memory (Feedly). The attack vector is network-based (AV:N), requires no privileges (PR:N) and no user interaction (UI:N), but is only exploitable when Fast DDS security mode is enabled. The fix, applied across three separate commits, completely refactors the built-in CDRMessage deserializers to use 64-bit arithmetic for length checks and introduces a wrap_from_other_message helper that enforces bounds before wrapping submessages (GitHub Commit 1, GitHub Commit 2, GitHub Commit 3).

Successful exploitation results in a remotely-triggered denial-of-service (DoS) through out-of-memory conditions, causing the Fast DDS process to terminate abnormally. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Any Fast DDS deployment with security mode enabled and network-accessible SPDP endpoints is at risk, including robotics, industrial control, and autonomous systems that rely on DDS middleware (Feedly, Debian Security Tracker).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.01% (0.000100), indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported.

1. Reconnaissance: Identify network-accessible Fast DDS instances with security mode enabled by scanning for RTPS/DDS traffic on UDP port 7400 (default SPDP multicast port) using tools like Wireshark or network scanners.
2. Craft malicious SPDP packet: Construct a valid RTPS SPDP (Simple Participant Discovery Protocol) packet containing a DATA Submessage targeting the PID_IDENTITY_TOKEN or PID_PERMISSIONS_TOKEN parameter IDs.
3. Tamper with vecsize: Set the vecsize field within the readOctetVector call to a crafted large value (e.g., near 0xFFFFFFFF) that will cause a 32-bit integer overflow when used in the length calculation inside readData.
4. Send the packet: Transmit the crafted SPDP packet to the target Fast DDS participant's discovery endpoint. No authentication or prior session establishment is required.
5. Trigger OOM and process termination: The overflowed length value causes Fast DDS to attempt an extremely large heap allocation, rapidly exhausting system memory and causing the Fast DDS process to crash, achieving denial-of-service (Feedly, GitHub Commit 1).

• Network: Unexpected or malformed RTPS SPDP packets on UDP port 7400 (or configured DDS discovery ports) containing anomalously large PID_IDENTITY_TOKEN or PID_PERMISSIONS_TOKEN field lengths; repeated SPDP packets from unknown or unexpected source IPs.
• Logs: Fast DDS process crash logs or core dumps with out-of-memory errors; system logs (e.g., dmesg, /var/log/syslog) showing OOM killer events targeting the Fast DDS process; application logs indicating unexpected participant discovery failures.
• Process: Sudden termination of Fast DDS participant processes without graceful shutdown; repeated restarts of DDS-dependent services or watchdog-triggered restarts.

Upgrade Fast DDS to the patched versions: 2.6.11, 3.3.1, or 3.4.1, depending on the currently deployed branch. The patches completely refactor CDRMessage deserializers to use 64-bit arithmetic for length calculations and add strict bounds checking before memory allocation (GitHub Commit 1, GitHub Commit 2, GitHub Commit 3). As a temporary workaround where immediate patching is not possible, restrict network access to Fast DDS SPDP discovery endpoints (UDP port 7400 by default) using firewall rules to limit exposure to trusted network segments only (Feedly). Note that Debian packages across bullseye, bookworm, trixie, and sid remain unfixed as of the advisory date and are tracked under Debian Bug #1121094 (Debian Security Tracker).