CVE-2023-42459

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). In affected versions specific DATA submessages can be sent to a discovery locator which may trigger a free error. This can remotely crash any Fast-DDS process. The call to free() could potentially leave the pointer in the attackers control which could lead to a double free. This issue has been addressed in versions 2.12.0, 2.11.3, 2.10.3, and 2.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-415 CWE-416 CWE-590

Affected software

Vendor	Product	Versions
eProsima	Fast-DDS	>= 2.11.0, <= 2.11.1; >= 2.10.0, < 2.10.3; < 2.6.7

References

https://github.com/eProsima/Fast-DDS/issues/3207Exploit, Issue Tracking
https://github.com/eProsima/Fast-DDS/pull/3824Patch
https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-gq8g-fj58-22gmVendor Advisory
https://www.debian.org/security/2023/dsa-5568Mailing List
https://github.com/eProsima/Fast-DDS/issues/3207Exploit, Issue Tracking
https://github.com/eProsima/Fast-DDS/pull/3824Patch
https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-gq8g-fj58-22gmVendor Advisory
https://www.debian.org/security/2023/dsa-5568Mailing List

Timeline

Published: Oct 16, 2023
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-42464.3The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing CVE-2023-424607.5Vyper is a Pythonic Smart Contract Language for the EVM. The `_abi_decode()` function does not validate input when it is nested in an expres CVE-2023-424619.8GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk CVE-2023-424629.1GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk CVE-2023-424637.8Wazuh is a free and open source platform used for threat prevention, detection, and response. This bug introduced a stack overflow hazard th CVE-2023-424649.8A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17. When parsing Spotlight RPC CVE-2023-424657.0Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is CVE-2023-424675.5QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not CVE-2023-424685.3The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent CVE-2023-424693.3The com.full.dialer.top.secure.encrypted application through 1.0.1 for Android enables any installed application (with no permissions) to pl CVE-2023-42475.4The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing CVE-2023-424709.8The Imou Life com.mm.android.smartlifeiot application through 6.8.0 for Android allows Remote Code Execution via a crafted intent to an expo