CVE-2026-22590
eprosima Fast DDS, a C++ implementation of the DDS standard, has a critical flaw that lets a remote attacker read memory beyond the bounds of a received packet. The vulnerability is triggered by a specially crafted RTPS `DATA_FRAG` submessage and can expose sensitive data to other participants in a Discovery Server setup. It is fixed in newer releases of Fast DDS.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
eprosima Fast DDS versions earlier than 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2. Users running these older versions in a DDS network are at risk.
Real-world impact
An attacker can send a malicious packet that causes the receiver to copy bytes from beyond the packet into its reassembly buffer. The leaked data may contain heap pointers or other sensitive information, potentially aiding an attacker in bypassing address space layout randomization (ASLR) and compromising the system.
Why this severity
The CVSS score of 9.1 reflects that the flaw is remotely exploitable with no authentication or user interaction, and it can lead to a complete loss of confidentiality and availability. The high impact on confidentiality and availability, combined with the low effort required to exploit, drives the critical rating.
What to do about it
- 01Upgrade eprosima Fast DDS to version 2.6.12, 2.14.6, 3.2.4, 3.3.1, 3.4.2, or any later release that includes the patch.
- 02Restart the Fast DDS service or application to ensure the new version is in use.
NVD-referenced vendor advisory
Timeline
- Sep 9, 2026 · 4d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 9, 2026 · 4d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.