CVE-2025-62799: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-62799 is a heap-based buffer overflow vulnerability in eProsima Fast-DDS, a C++ implementation of the DDS (Data Distribution Service) standard. The flaw exists in the RTPS DATA_FRAG receive path and allows an unauthenticated remote attacker to crash the affected process or potentially achieve remote code execution by sending a single malformed RTPS DATA_FRAG packet. Affected versions include all releases prior to 2.6.11, versions 3.0.0 through 3.3.0, and version 3.4.0; Debian Linux 11.0, 12.0, and 13.0 are also listed as affected platforms. The vulnerability was published on February 3, 2026, with patches released in versions 3.4.1, 3.3.1, and 2.6.11. It carries a CVSS v3.1 base score of 9.8 (Critical) (Red Hat CVE, Feedly).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). During fragment metadata initialization in the DATA_FRAG receive path, the code performs a 4-byte alignment step when writing a fragment index at the beginning of each fragment. When an attacker crafts a packet where fragmentSize and sampleSize violate internal assumptions — for example, fragmentSize=50002 and sampleSize=50003 — the alignment calculation causes the code to write past the end of the allocated payload buffer. The fix introduces a new calculate_required_fragmented_payload_size() function in CacheChange_t that validates and computes the minimum required buffer size (accounting for alignment) before allocation, and updates reserve_cache() in both StatefulReader and StatelessReader to pass the fragment size for pre-allocation validation (GitHub Commit v3.4.1, GitHub Commit v3.3.1, GitHub Commit v2.6.11).

Successful exploitation causes an immediate process crash (Denial of Service) in any application using a vulnerable Fast-DDS version that is reachable over the network. Beyond DoS, the heap buffer overflow carries a realistic risk of memory corruption that could be leveraged for remote code execution, potentially allowing an attacker to gain full control of the affected host. Because Fast-DDS is widely used in robotics (ROS 2), industrial automation, and other real-time distributed systems, exploitation could affect safety-critical infrastructure. No authentication or user interaction is required, meaning any network-accessible Fast-DDS endpoint is a viable target (Red Hat CVE, Feedly).

As of the time of reporting, no public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.014% (0.000140), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. However, the network-accessible, unauthenticated, zero-interaction attack vector makes this vulnerability highly attractive for future weaponization, particularly against ROS 2 and industrial DDS deployments.

1. Reconnaissance: Identify hosts running Fast-DDS versions prior to 2.6.11, 3.3.1, or 3.4.1 that are reachable over the network (e.g., via UDP port scanning for RTPS traffic, typically on ports 7400–7500).
2. Craft malicious RTPS DATA_FRAG packet: Construct a raw RTPS packet with submessage ID 0x16 (DATA_FRAG), setting fragmentSize and sampleSize to values that violate internal alignment assumptions — for example, fragment_size=50002 and sample_size=50003 as demonstrated in the upstream regression test.
3. Set packet headers: Populate the RTPS header with a valid GuidPrefix (can be spoofed or obtained via passive observation of DDS discovery traffic), and set reader_id and writer_id to target a known or guessed entity.
4. Transmit the packet: Send the crafted UDP packet directly to the target Fast-DDS reader's unicast locator (IP and port). No prior session establishment or authentication is required.
5. Trigger overflow: Upon receipt, the vulnerable reserve_cache() path allocates a buffer based on sampleSize without accounting for the 4-byte alignment overhead, causing an out-of-bounds write during fragment index initialization — resulting in a crash or potential memory corruption (GitHub Commit v3.4.1).

• Network: Unexpected UDP packets with RTPS magic bytes (RTPS) and submessage ID 0x16 (DATA_FRAG) containing anomalous fragmentSize/sampleSize combinations (e.g., fragmentSize close to or equal to sampleSize, or values near 50000); inbound RTPS traffic from unknown or unexpected source IPs.
• Logs: Fast-DDS log warnings such as Required payload size calculation overflows for payload size '...' and fragment size '...' (present in patched versions; absence of this warning on unpatched systems may indicate silent exploitation); application crash logs or core dumps from the Fast-DDS process.
• Process: Unexpected termination (crash) of processes using Fast-DDS, particularly those acting as RTPS readers; core dump files generated by the DDS application process.
• File System: Presence of core dump files (e.g., core, core.<pid>) in the working directory of the Fast-DDS application following unexpected process termination.

Upgrade Fast-DDS to a patched version immediately: 2.6.11 (for pre-3.0.0 deployments), 3.3.1 (for 3.0.0–3.3.0 branch), or 3.4.1 (for 3.4.0). Three separate patch commits address the issue across all supported branches (GitHub Commit v3.4.1, GitHub Commit v3.3.1, GitHub Commit v2.6.11). As a network-level workaround where patching is not immediately possible, implement network segmentation and firewall rules to restrict RTPS/UDP traffic (typically ports 7400–7500) to trusted hosts only, preventing unauthenticated external senders from reaching Fast-DDS endpoints. Note that Debian packages for bullseye, bookworm, and trixie remain unfixed as of the advisory date; Debian users should monitor the security tracker for updated packages (Debian Security Tracker).

Red Hat has published a CVE advisory page tracking the vulnerability (Red Hat CVE). The Debian Security Tracker lists the vulnerability as affecting bullseye, bookworm, trixie, and sid, with no fixed Debian package available at time of disclosure and the issue noted as "Minor" for stable releases (Debian Security Tracker). No significant public researcher commentary or social media discussion beyond automated vulnerability database aggregation has been identified for this CVE.