{"id":"CVE-2026-22590","aliases":["DEBIAN-CVE-2026-22590","EUVD-2026-75058","GHSA-7r7h-hwfj-q626","UBUNTU-CVE-2026-22590"],"status":"published","title":"Fast-DDS Discovery Server: Out-of-Bounds Read \u0026 Heap Memory Disclosure via DATA_FRAG  sampleSize / fragmentsInSubmessage","description":"eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS `DATA_FRAG` submessages. An attacker can craft a `DATA_FRAG` with a large `sampleSize` but a small actual payload, and set `fragmentsInSubmessage` such that the receiver treats the packet as the LAST fragment**. In this LAST-fragment path, Fast-DDS computes `incoming_length` based on `sampleSize` and calls `memcpy()` without validating `incoming_data.length \u003e= incoming_length`. As a result, `CacheChange_t::add_fragments()` reads past the received UDP datagram buffer and into adjacent heap memory, copying those bytes into the reassembly buffer. In a Discovery Server deployment, the resulting `CacheChange_t` can be relayed to other participants, meaning that a newly joining participant may receive leaked heap memory (e.g., pointer values that could aid ASLR bypass). Versions 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 fix the issue.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00539,"percentile":0.45844,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125","CWE-131"],"published":"2026-09-09T15:43:28Z","modified":"2026-10-28T02:30:38Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"fastdds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.1+ds-1","2.10.1+ds-2","2.10.1+ds-3","2.11.2+ds-1","2.11.2+ds-2","2.11.2+ds-3","2.11.2+ds-4","2.11.2+ds-5","2.11.2+ds-6","2.11.2+ds-6.1","2.11.2+ds-6.1~exp1","2.14.0+ds-1","2.14.0+ds-2","2.14.0+ds-3","2.14.0+ds-4","2.14.1+ds-1","2.14.2+ds-1","2.14.3+ds-1","2.9.1+ds-1","2.9.1+ds-1+deb12u1","2.9.1+ds-1+deb12u2","3.0.0+ds-1","3.0.0+ds-2","3.0.0+ds-3","3.0.1+ds-1","3.1.0+ds-1","3.1.0+ds-2","3.1.2+ds-1","3.3.0+ds-1","3.3.0+ds-2","3.3.0+ds-3","3.6.1+ds-1"]},{"source":"osv","ecosystem":"Debian:13","package":"fastdds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2+ds-1","3.3.0+ds-1","3.3.0+ds-2","3.3.0+ds-3","3.6.1+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"fastdds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0+ds-9","2.4.1+ds-1","2.5.0+ds-3","2.5.0+ds-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"fastdds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.1+ds-3","2.11.2+ds-6","2.11.2+ds-6ubuntu1","2.11.2+ds-6.1build2","2.11.2+ds-6.1build3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"fastdds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.0+ds-3ubuntu1","3.3.0+ds-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"fastdds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2+ds-1build1","3.3.0+ds-3ubuntu1"]}],"products":[{"vendor":"eprosima","product":"fast-dds"}],"references":[{"url":"https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-7r7h-hwfj-q626","tags":["x_refsource_CONFIRM","exploit","advisory","report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22590.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22590","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-22590","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-22590","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-22590","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-22590","title":"Fast-DDS Discovery Server: Out-of-Bounds Read \u0026 Heap Memory Disclosure via DATA_FRAG  sampleSize / fragmentsInSubmessage","description":"eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS `DATA_FRAG` submessages. An attacker can craft a `DATA_FRAG` with a large `sampleSize` but a small actual payload, and set `fragmentsInSubmessage` such that the receiver treats the packet as the LAST fragment**. In this LAST-fragment path, Fast-DDS computes `incoming_length` based on `sampleSize` and calls `memcpy()` without validating `incoming_data.length \u003e= incoming_length`. As a result, `CacheChange_t::add_fragments()` reads past the received UDP datagram buffer and into adjacent heap memory, copying those bytes into the reassembly buffer. In a Discovery Server deployment, the resulting `CacheChange_t` can be relayed to other participants, meaning that a newly joining participant may receive leaked heap memory (e.g., pointer values that could aid ASLR bypass). Versions 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 fix the issue.","status":"published","published":"2026-09-09T15:43:28.589Z","modified":"2026-09-09T16:08:57.108Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-125","CWE-131"],"updated_at":"2026-11-02T13:39:05.585774Z"}],"euvd":[{"id":"EUVD-2026-75058","description":"eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS `DATA_FRAG` submessages. An attacker can craft a `DATA_FRAG` with a large `sampleSize` but a small actual payload, and set `fragmentsInSubmessage` such that the receiver treats the packet as the LAST fragment**. In this LAST-fragment path, Fast-DDS computes `incoming_length` based on `sampleSize` and calls `memcpy()` without validating `incoming_data.length \u003e= incoming_length`. As a result, `CacheChange_t::add_fragments()` reads past the received UDP datagram buffer and into adjacent heap memory, copying those bytes into the reassembly buffer. In a Discovery Server deployment, the resulting `CacheChange_t` can be relayed to other participants, meaning that a newly joining participant may receive leaked heap memory (e.g., pointer values that could aid ASLR bypass). Versions 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 fix the issue.","status":"published","published":"2026-09-09T15:43:28Z","modified":"2026-09-09T16:08:57Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T17:28:26.437971Z"}],"nvd":[{"id":"CVE-2026-22590","description":"eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS `DATA_FRAG` submessages. An attacker can craft a `DATA_FRAG` with a large `sampleSize` but a small actual payload, and set `fragmentsInSubmessage` such that the receiver treats the packet as the LAST fragment**. In this LAST-fragment path, Fast-DDS computes `incoming_length` based on `sampleSize` and calls `memcpy()` without validating `incoming_data.length \u003e= incoming_length`. As a result, `CacheChange_t::add_fragments()` reads past the received UDP datagram buffer and into adjacent heap memory, copying those bytes into the reassembly buffer. In a Discovery Server deployment, the resulting `CacheChange_t` can be relayed to other participants, meaning that a newly joining participant may receive leaked heap memory (e.g., pointer values that could aid ASLR bypass). Versions 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 fix the issue.","status":"published","published":"2026-09-09T16:17:02.387Z","modified":"2026-09-09T20:16:54.383Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-125","CWE-131"],"updated_at":"2026-11-02T14:12:45.93749Z"}],"osv":[{"id":"CVE-2026-22590","title":"Fast-DDS Discovery Server: Out-of-Bounds Read \u0026 Heap Memory Disclosure via DATA_FRAG  sampleSize / fragmentsInSubmessage","description":"eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS `DATA_FRAG` submessages. An attacker can craft a `DATA_FRAG` with a large `sampleSize` but a small actual payload, and set `fragmentsInSubmessage` such that the receiver treats the packet as the LAST fragment**. In this LAST-fragment path, Fast-DDS computes `incoming_length` based on `sampleSize` and calls `memcpy()` without validating `incoming_data.length \u003e= incoming_length`. As a result, `CacheChange_t::add_fragments()` reads past the received UDP datagram buffer and into adjacent heap memory, copying those bytes into the reassembly buffer. In a Discovery Server deployment, the resulting `CacheChange_t` can be relayed to other participants, meaning that a newly joining participant may receive leaked heap memory (e.g., pointer values that could aid ASLR bypass). Versions 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 fix the issue.","status":"published","published":"2026-09-09T15:43:28.589Z","modified":"2026-10-28T02:30:38.597435871Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-125","CWE-131"],"updated_at":"2026-11-02T15:44:58.42038Z"},{"id":"DEBIAN-CVE-2026-22590","description":"eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS `DATA_FRAG` submessages. An attacker can craft a `DATA_FRAG` with a large `sampleSize` but a small actual payload, and set `fragmentsInSubmessage` such that the receiver treats the packet as the LAST fragment**. In this LAST-fragment path, Fast-DDS computes `incoming_length` based on `sampleSize` and calls `memcpy()` without validating `incoming_data.length \u003e= incoming_length`. As a result, `CacheChange_t::add_fragments()` reads past the received UDP datagram buffer and into adjacent heap memory, copying those bytes into the reassembly buffer. In a Discovery Server deployment, the resulting `CacheChange_t` can be relayed to other participants, meaning that a newly joining participant may receive leaked heap memory (e.g., pointer values that could aid ASLR bypass). Versions 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 fix the issue.","status":"published","published":"2026-09-09T16:17:02.387Z","modified":"2026-10-01T03:02:30.428906918Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"UBUNTU-CVE-2026-22590","description":"eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 have a remotely triggerable Out-of-Bounds Read while processing RTPS `DATA_FRAG` submessages. An attacker can craft a `DATA_FRAG` with a large `sampleSize` but a small actual payload, and set `fragmentsInSubmessage` such that the receiver treats the packet as the LAST fragment**. In this LAST-fragment path, Fast-DDS computes `incoming_length` based on `sampleSize` and calls `memcpy()` without validating `incoming_data.length \u003e= incoming_length`. As a result, `CacheChange_t::add_fragments()` reads past the received UDP datagram buffer and into adjacent heap memory, copying those bytes into the reassembly buffer. In a Discovery Server deployment, the resulting `CacheChange_t` can be relayed to other participants, meaning that a newly joining participant may receive leaked heap memory (e.g., pointer values that could aid ASLR bypass). Versions 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 fix the issue.","status":"published","published":"2026-09-09T16:17:00Z","modified":"2026-10-17T12:59:55.122479488Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:01.334185Z"}]}}