CVEvulnerability

CVE-2023-42459

7.5 HIGH Published 2023-10-16 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2023-10-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-415, CWE-416, CWE-590

Description

Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). In affected versions specific DATA submessages can be sent to a discovery locator which may trigger a free error. This can remotely crash any Fast-DDS process. The call to free() could potentially leave the pointer in the attackers control which could lead to a double free. This issue has been addressed in versions 2.12.0, 2.11.3, 2.10.3, and 2.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected configurations

• eprosima fast dds (< 2.6.7) • eprosima fast dds (>= 2.10.0 < 2.10.3) • eprosima fast dds (>= 2.11.0 <= 2.11.1)

Related

Weakness · CWE (3)

  • CWE-415 Double Free weakness
  • CWE-416 Use After Free weakness
  • CWE-590 Free of Memory not on the Heap weakness

References