CVE-2025-62799 FastDDS's heap buffer overflow in RTPS DATA_FRAG enables unauthenticated DoS (potential RCE)
Unauthenticated attackers can cause denial of service or potential remote code execution via a heap buffer overflow in Fast DDS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-62799?
CVE-2025-62799 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 3 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6.11, a heap buffer overflow exists in the Fast-DDS DATA_FRAG receive path. An un authenticated sender can transmit a single malformed RTPS DATA_FRAG packet where `fragmentSize` and `sampleSize` are craft ed to violate internal assumptions. Due to a 4-byte alignment step during fragment metadata initialization, the code write s past the end of the allocated payload buffer, causing immediate crash (DoS) and potentially enabling memory corruption ( RCE risk). Versions 3.4.1, 3.3.1, and 2.6.11 patch the issue.
Which versions are affected by CVE-2025-62799?
It affects 2 products.
Products include Debian Debian Linux, Eprosima Fast Dds.
How do I fix CVE-2025-62799?
No fix has been published for CVE-2025-62799 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-62799 being exploited?
There is no known exploitation of CVE-2025-62799 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2025-62799, UBUNTU-CVE-2025-62799.