CVE-2025-62603: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-62603 is an out-of-bounds read / memory exhaustion vulnerability in eProsima Fast DDS, a C++ implementation of the OMG Data Distribution Service (DDS) standard. The flaw resides in the ParticipantGenericMessage CDR parser, which fully deserializes the entire DataHolderSeq structure of incoming DDS Security control messages without first performing minimal header validation, enabling remote attackers to trigger out-of-memory conditions and crash the process. Affected versions are Fast DDS prior to 2.6.11, 3.0.0–3.3.0 (fixed in 3.3.1), and 3.4.0 (fixed in 3.4.1); Debian Linux 11.0, 12.0, and 13.0 ship vulnerable packages (Feedly, Debian Tracker). The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Feedly).

The root cause is classified as CWE-125 (Out-of-bounds Read), manifesting as premature and complete parsing of untrusted CDR-encoded message structures without bounds enforcement. When a ParticipantGenericMessage is received over RTPS, the CDR parser traverses the readParticipantGenericMessage → readDataHolderSeq path and sequentially deserializes a uint32 sequence count, class_id strings, string property key/value pairs, and binary property octet-vectors — all at a stateless level before any identity or sequence-number check is performed (Debian Tracker). Because RTPS permits duplicates, delays, and retransmissions, a receiver must parse at least a minimal header to decide whether to discard a message; the vulnerable implementation instead fully unfolds the entire DataHolderSeq, allowing a crafted packet to drive unbounded memory allocation. The fix refactors the built-in CDR deserializers in CDRMessage, adds arithmetic overflow guards on length calculations, and introduces CDRMessage_t::wrap_from_other_message() to safely bound sub-message parsing (Fast-DDS Commit 3542185, Fast-DDS Commit a726e6a).

Successful exploitation causes an out-of-memory condition that remotely terminates the Fast DDS process, resulting in a complete denial of service for any application relying on DDS-based communication — including robotics (ROS 2), industrial control, and autonomous systems (Feedly). There is no confidentiality or integrity impact; the sole consequence is availability loss. Because DDS is commonly used in safety-critical and real-time environments, process termination can have cascading effects on dependent systems or physical processes (Debian Tracker).

No public proof-of-concept exploit or evidence of in-the-wild exploitation has been reported (Feedly). The vulnerability is network-exploitable with no authentication or user interaction required (CVSS AV:N/AC:L/PR:N/UI:N), making it straightforward to trigger against any reachable Fast DDS endpoint. The EPSS score is approximately 0.028% (0.000280), indicating a currently low probability of exploitation in the near term (Feedly). The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Reconnaissance: Identify hosts running Fast DDS (versions < 2.6.11, 3.0.0–3.3.0, or 3.4.0) by scanning for open RTPS UDP ports (default 7400/7401 and discovery ports) using tools such as Nmap or Shodan.
2. Craft malicious ParticipantGenericMessage: Construct a DDS Security ParticipantGenericMessage RTPS packet with a DataHolderSeq containing an inflated sequence count or oversized class_id/property fields that exceed available buffer bounds.
3. Transmit over RTPS: Send the crafted UDP datagram to the target's RTPS discovery or unicast port. No prior handshake or authentication is required, as the CDR parser processes the message before any security state is checked.
4. Trigger out-of-memory: The stateless CDR parser fully deserializes the malformed DataHolderSeq, causing unbounded memory allocation that exhausts the process heap and terminates the Fast DDS process, achieving denial of service (Debian Tracker, Feedly).

• Network: Unexpected or malformed UDP packets targeting RTPS ports (7400, 7401, or configured DDS discovery ports) with oversized DataHolderSeq payloads; high-volume RTPS traffic from untrusted sources.
• Process: Sudden termination or crash of the Fast DDS process (e.g., fastdds, ros2 nodes, or any DDS-participant process) with out-of-memory errors or SIGKILL/SIGABRT signals.
• Logs: System logs (/var/log/syslog, journalctl) showing OOM killer events targeting DDS participant processes; application logs indicating unexpected process exits or restart loops.
• File System: Core dump files generated by the Fast DDS process in the working directory or /var/crash/, potentially timestamped around the time of anomalous RTPS traffic.

Upgrade Fast DDS to a patched version: 2.6.11 (for the 2.6.x branch), 3.3.1 (for the 3.3.x branch), or 3.4.1 (for the 3.4.x branch) (Feedly, Fast-DDS Commit 3542185). As interim mitigations: implement network segmentation to restrict RTPS/DDS traffic to trusted hosts only; consider disabling DDS Security features if not operationally required; and monitor process memory consumption for unexpected spikes. Debian packages remain unfixed in stable/testing branches as of the advisory date, so Debian users should apply upstream patches or restrict network exposure (Debian Tracker).

Red Hat has published a security advisory tracking this CVE (Red Hat Advisory). The Debian Security Tracker classifies the issue as a "minor issue" for stable branches (bullseye, bookworm, trixie), indicating it is not considered critical enough for immediate stable updates (Debian Tracker). No significant researcher commentary or broader media coverage has been identified at this time.