CVE-2024-10838 Integer Underflow in DDS_Security_Deserialize_ methods may lead to OOB read
An integer underflow in Eclipse Cyclone DDS allows unauthenticated attackers to read out-of-bounds memory, potentially leaking secrets or causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-10838?
CVE-2024-10838 is a high-severity vulnerability in Eclipse Cyclone DDS, published on 12 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An integer underflow during deserialization may allow any unauthenticated user to read out of bounds heap memory. This may result into secret data or pointers revealing the layout of the address space to be included into a deserialized data structure, which may potentially lead to thread crashes or cause denial of service conditions.
Weakness: CWE-191
Which versions are affected by CVE-2024-10838?
It affects 1 product.
Products include Eclipse Cyclone Data Distribution Service.
How do I fix CVE-2024-10838?
No fix has been published for CVE-2024-10838 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-10838 being exploited?
There is no known exploitation of CVE-2024-10838 in the wild and no public exploit code.
Other vulnerabilities in Eclipse Cyclone DDS
Sources
Also known as GHSA-6jj6-w25p-jc42, UBUNTU-CVE-2024-10838.