Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

FastDDS can crash from uncaught Fast CDR error

CVE-2023-39948 · published 3 years ago
Summary

The FastDDS library used on Debian systems may stop working if it receives an unexpected data type, because an internal error is not handled correctly. This can cause the service to terminate remotely. Upgrade to FastDDS version 2.10.0 or newer (or 2.6.5 or newer) to fix the problem.

What to do
  • Update debian fastdds to version 2.9.1+ds-1+deb12u1.
  • Update debian fastdds to version 2.10.1+ds-2.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian fastdds < 2.9.1+ds-1+deb12u1
Fix: upgrade to 2.9.1+ds-1+deb12u1
Debian:13 debian fastdds < 2.10.1+ds-2
Fix: upgrade to 2.10.1+ds-2
Original advisory text
Uncaught fastcdr exception (Unexpected CDR type received) crashing fastdds
eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0 and 2.6.5, the `BadParamException` thrown by Fast CDR is not caught in Fast DDS. This can remotely crash any Fast DDS process. Versions 2.10.0 and 2.6.5 contain a patch for this issue.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Type
CWE-248Uncaught Exception
Timeline
Published11 Aug 2023
Updated31 Oct 2026
First seen2 Apr 2026
Sources
CVE-2023-39948 · OSV
GHSA-x9pj-vrgf-f68f · GHSA
CVE-2023-39948 · NVD
DEBIAN-CVE-2023-39948 · OSV
Track software like this
Free during beta