CVE-2025-64098: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-64098 is an integer overflow vulnerability in eProsima Fast DDS (a C++ implementation of the OMG Data Distribution Service standard) that causes an Out-Of-Memory (OOM) condition and remote process termination when security mode is enabled. The flaw affects Fast DDS versions prior to 2.6.11, versions 3.0.0 through 3.3.0, and version 3.4.0. It was published on February 3, 2026, and patched in versions 3.4.1, 3.3.1, and 2.6.11 (Feedly, Debian Security Tracker). The CVSS v3.1 base score is 5.9 (Medium) (Feedly).

The vulnerability is classified under CWE-190 (Integer Overflow or Wraparound) and CWE-125 (Out-of-bounds Read). When security mode is enabled, an attacker can craft a malicious SPDP (Simple Participant Discovery Protocol) packet containing a tampered DATA Submessage. Specifically, tampering with the vecsize value read by readOctetVector in the PID_IDENTITY_TOKEN or PID_PERMISSIONS_TOKEN fields causes a 32-bit integer overflow, which in turn causes std::vector::resize to allocate an attacker-controlled, arbitrarily large memory size, rapidly exhausting available memory (Feedly). The fix refactors the built-in CDRMessage deserializers to use 64-bit arithmetic for length checks and introduces bounds-checked message wrapping via a new CDRMessage_t::wrap_from_other_message helper (GitHub Commit 1, GitHub Commit 2).

Successful exploitation results in remote termination of the Fast DDS publisher process via an OOM condition, constituting a Denial of Service (DoS) with high availability impact. There is no confidentiality or integrity impact — the attacker cannot read or modify data, only crash the affected process. Any deployment of Fast DDS with security mode enabled is at risk, including robotics, industrial automation, and other real-time distributed systems that rely on DDS middleware (Feedly).

No public proof-of-concept exploit or evidence of in-the-wild exploitation has been reported as of the time of writing (Feedly). The EPSS score is 0.01% (0.000100), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires no authentication and no user interaction, but does require the attacker to be able to send crafted SPDP packets to the target, which may involve network access to the DDS discovery multicast/unicast channel (Feedly).

1. Reconnaissance: Identify hosts running Fast DDS with security mode enabled (versions prior to 2.6.11, 3.3.1, or 3.4.1) on the network. DDS discovery typically uses UDP multicast on port 7400 or unicast on configurable ports.
2. Craft malicious SPDP packet: Construct a valid SPDP (Simple Participant Discovery Protocol) packet containing a DATA Submessage with tampered PID_IDENTITY_TOKEN or PID_PERMISSIONS_TOKEN fields. Specifically, set the vecsize field read by readOctetVector to a large value that, when processed as a 32-bit integer, causes an overflow.
3. Send the packet: Transmit the crafted packet to the target Fast DDS participant over the network (UDP multicast or unicast to the DDS discovery endpoint).
4. Trigger OOM: The vulnerable readOctetVector function passes the overflowed vecsize to std::vector::resize, causing the process to attempt a massive memory allocation, rapidly exhausting system memory and terminating the Fast DDS process (Feedly, GitHub Commit 1).

• Network: Unexpected or malformed UDP packets targeting DDS discovery ports (default: 7400/UDP multicast, or configured unicast ports) with anomalously large PID_IDENTITY_TOKEN or PID_PERMISSIONS_TOKEN field sizes in SPDP DATA Submessages.
• Process: Sudden, unexplained termination of Fast DDS publisher or participant processes; OOM killer (Linux oom-killer) log entries attributing kills to the Fast DDS process.
• Logs: System logs (e.g., /var/log/syslog, /var/log/kern.log) showing out-of-memory events or process crashes correlated with DDS network activity; application crash dumps from the Fast DDS process.
• File System: Core dump files generated by the Fast DDS process at the time of the crash, potentially in the working directory or configured core dump location.

Upgrade Fast DDS to one of the patched versions: 3.4.1, 3.3.1, or 2.6.11. Patch commits are available in the eProsima/Fast-DDS GitHub repository (GitHub Commit 1, GitHub Commit 2, GitHub Commit 3). For organizations unable to patch immediately, consider disabling security mode if operationally feasible, implementing network segmentation to restrict which hosts can send SPDP packets to DDS participants, and monitoring for unexpected process crashes (Feedly). Note that Debian packages across bullseye, bookworm, trixie, and sid remain unfixed as of the advisory date (Debian Security Tracker).