CVE-2023-50716 Invalid DATA_FRAG Submessage causes a bad-free error

What is CVE-2023-50716?

CVE-2023-50716 is a critical use after free vulnerability in eProsima Fast-DDS, published on 6 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.13.0, 2.12.2, 2.11.3, 2.10.3, and 2.6.7, an invalid DATA_FRAG Submessage causes a bad-free error, and the Fast-DDS process can be remotely terminated. If an invalid Data_Frag packet is sent, the `Inline_qos, SerializedPayload` member of object `ch` will attempt to release memory without initialization, resulting in a 'bad-free' error. Versions 2.13.0, 2.12.2, 2.11.3, 2.10.2, and 2.6.7 fix this issue.

Weakness: CWE-416

Which versions are affected by CVE-2023-50716?

It affects 1 product.

Products include Eprosima Fast Dds.

How do I fix CVE-2023-50716?

Upgrade to a fixed version.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2023-50716 being exploited?

There is no known exploitation of CVE-2023-50716 in the wild and no public exploit code.

Other vulnerabilities in eProsima Fast-DDS

• CVE-2025-67108 Security feature bypass in n/a Critical 10.0
• CVE-2024-28231 Manipulated DATA Submessage causes a heap-buffer-overflow error Critical 9.7
• CVE-2023-50257 Disconnect Vulnerability in RTPS Packets Used by SROS2 Critical 9.7
• CVE-2023-42459 Malformed DATA submessage leads to bad-free error in Fast-DDS High 8.6
• CVE-2024-30258 FastDDS crash when publisher send malformed packet High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2023-50716, GHSA-5m2f-hvj2-cx2h, UBUNTU-CVE-2023-50716.