CVE-2025-65865: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-65865 is an integer overflow vulnerability in eProsima Fast-DDS v3.3.0 that allows unauthenticated remote attackers to cause a Denial of Service (DoS) via crafted input. The vulnerability was published on December 23, 2025, and affects specifically Fast-DDS version 3.3.0. It carries a CVSS v3.1 base score of 7.5 (High), assessed by CISA-ADP (Red Hat Advisory, Feedly).

The vulnerability is classified as CWE-190 (Integer Overflow or Wraparound) and resides in the proc_Submsg_DataFrag function within MessageReceiver.cpp of the Fast-DDS RTPS protocol implementation. An integer underflow occurs when calculating payload_size if submessageLength is less than the sum of octetsToInlineQos and inlineQosSize, causing payload_size to wrap around to a very large value near the upper limit of uint32_t. This causes the msg->pos pointer to perform an out-of-bounds access, subsequently triggering a memcpy operation in the add_fragments function that copies excessively large data, ultimately resulting in a segmentation fault or arbitrary memory read. Exploitation requires the attacker to monitor the GUID and entityId information of the target system and send malicious RTPS packets over UDP (GitHub Gist).

Successful exploitation causes a Denial of Service condition by crashing the affected Fast-DDS service via a segmentation fault, disrupting availability for any system or application relying on the middleware. There is also a potential for arbitrary memory read, which could expose sensitive in-memory data. The attack requires no authentication and no user interaction, making it accessible to any network-adjacent or remote attacker who can send UDP packets to the target (GitHub Gist, Feedly).

A proof-of-concept exploit is publicly available on GitHub, published by researcher lkloliver on December 23, 2025, alongside a detailed technical write-up (GitHub Gist). The vulnerability is detectable via Nessus plugin 279648. The EPSS score is approximately 0.041%, indicating a low but non-zero probability of exploitation in the wild. No active in-the-wild exploitation has been confirmed, and the CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, Tenable).

1. Reconnaissance: Identify target systems running eProsima Fast-DDS v3.3.0 on the network. Monitor or sniff network traffic to obtain the target's RTPS GUID and entityId information, which are required to craft valid RTPS packets.
2. Craft malicious RTPS DataFrag sub-message: Construct a malicious RTPS packet containing a DataFrag sub-message where submessageLength is set to a value less than the sum of octetsToInlineQos and inlineQosSize, triggering the integer underflow in proc_Submsg_DataFrag.
3. Send crafted packet via UDP: Transmit the malicious RTPS packet to the target system over UDP, targeting the port used by the Fast-DDS service.
4. Trigger integer underflow: The vulnerable payload_size calculation wraps around to a near-maximum uint32_t value, causing msg->pos to reference out-of-bounds memory.
5. Achieve DoS or memory read: The subsequent memcpy in add_fragments copies an excessively large amount of data, causing a segmentation fault (DoS) or potentially reading arbitrary memory contents (GitHub Gist).

• Network: Unexpected or malformed UDP packets targeting Fast-DDS RTPS ports (default: 7400/UDP, 7401/UDP) with anomalous DataFrag sub-messages; packets with submessageLength values inconsistent with octetsToInlineQos and inlineQosSize fields.
• Process: Sudden crash or restart of Fast-DDS service processes; segmentation fault signals (SIGSEGV) generated by the Fast-DDS process.
• Logs: System logs (e.g., /var/log/syslog, dmesg) showing segmentation fault entries for the Fast-DDS process; application-level crash dumps or core files associated with the Fast-DDS executable.
• File System: Unexpected core dump files in the working directory of the Fast-DDS application following a crash event (GitHub Gist).

No official patch from eProsima has been confirmed in the available data; users should monitor eProsima's official security advisories and the Fast-DDS GitHub repository for a patched release. As interim mitigations, implement network segmentation to restrict UDP access to Fast-DDS services to trusted hosts only, and apply firewall rules to block unauthorized access to RTPS ports (default 7400–7401/UDP). Rate limiting and strict input validation at the network perimeter can reduce exposure. Organizations should also monitor for anomalous RTPS traffic patterns as described in the IOCs section (Red Hat Advisory, Feedly).

Red Hat has published a security advisory tracking CVE-2025-65865, indicating awareness among enterprise Linux vendors (Red Hat Advisory). A technical blog post was published at infinitsec.net covering the vulnerability details shortly after disclosure (Infinitsec Post). No significant broader community or social media discussion has been identified beyond standard CVE tracking aggregators.