CVE-2026-22590

eProsima Fast DDS, the C++ implementation of the OMG DDS standard, contains a remotely triggerable out-of-bounds read (CWE-125/CWE-131, CVSS 9.1 critical) when processing RTPS DATA_FRAG submessages in versions prior to 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2. An attacker who can send packets to a participant can craft a DATA_FRAG marked as the LAST fragment with a large sampleSize but a small actual payload; the receiver computes incoming_length from sampleSize and calls memcpy() without checking that the received datagram is that long, so CacheChange_t::add_fragments() reads past the UDP buffer into adjacent heap memory. The leaked bytes are copied into the reassembly buffer, and in Discovery Server deployments the resulting CacheChange_t can be relayed to other participants, meaning a newly joining participant may receive heap contents such as pointer values that could aid ASLR bypass. Any deployment running a vulnerable Fast DDS version is affected where an attacker can reach its RTPS traffic, notably ROS 2 (where Fast DDS is the default middleware) as well as standalone robotics, simulation, and industrial DDS systems. No exploitation has been reported, no public proof-of-concept exists, and the issue is not in the CISA KEV; fixed releases are already available.

What to do: Upgrade Fast DDS to 2.6.12, 2.14.6, 3.2.4, 3.3.1, or 3.4.2, matching your deployment's version line. Until patched, restrict network access to RTPS endpoints so only trusted hosts can send DATA_FRAG traffic, and be aware that Discovery Server participants may receive relayed leaked heap data from vulnerable relays. No public exploit is known, but the flaw requires no authentication or user interaction, so prioritize patching deployments reachable by untrusted networks or third-party participants.