CVE-2026-22590: eProsima Fast DDS Heap Memory Disclosure via DATA_FRAG

Out-of-Bounds Heap Read in Fast DDS's Fragment Reassembly

CVE-2026-22590 is a remotely triggerable out-of-bounds read (CWE-125) in eProsima Fast DDS, a widely used C++ implementation of the OMG Data Distribution Service standard for real-time, publish-subscribe data exchange in robotics, automotive, industrial, and defense systems. The flaw sits in how Fast DDS reassembles fragmented RTPS messages, and it carries a CVSS score of 9.1 (Critical).

Vulnerability Details

An attacker can craft a DATA_FRAG submessage that declares a large sampleSize while sending a much smaller actual payload, and set fragmentsInSubmessage so the receiver treats the packet as the last fragment. On that code path, Fast DDS computes the expected incoming_length from the declared sampleSize and calls memcpy() without validating that the received data is actually that long. The result: CacheChange_t::add_fragments() reads past the end of the received UDP datagram and copies adjacent heap memory into the reassembly buffer — memory the attacker never sent.

In a Discovery Server deployment, that corrupted CacheChange_t can be relayed onward to other participants, meaning a newly joining, otherwise-uninvolved participant may receive leaked heap contents — including pointer values that could assist an ASLR bypass in a follow-on attack.

A fuzzing-based proof of concept confirmed the bug, triggering an AddressSanitizer heap-buffer-overflow READ inside CacheChange_t::add_fragments(), called from StatefulReader::processDataFragMsg() during normal message reception.

Affected Products

Fast DDS versions prior to:

• 2.6.12
• 2.14.6
• 3.2.4
• 3.3.1
• 3.4.2

Why This Matters

DDS middleware underpins real-time control loops in robotics fleets, autonomous vehicles, industrial automation, and defense systems — environments where a heap-memory leak is rarely "just" an information disclosure bug. Because the leaked bytes can be relayed through a Discovery Server to other participants, the blast radius extends beyond the directly targeted node: any participant that joins the same discovery domain after exploitation could receive memory contents it never should have seen, handing an attacker reconnaissance data (such as heap pointers) useful for chaining into a more serious memory-corruption exploit.

Remediation

• Upgrade Fast DDS to 2.6.12, 2.14.6, 3.2.4, 3.3.1, or 3.4.2 (whichever tracks your current branch) — all five fix the missing bounds check before the fragment memcpy()
• The fix is also folded into the upstream 2.14.6 release notes as a named CVE fix

Interim Mitigations

If an immediate upgrade isn't feasible:

1. Restrict incoming RTPS traffic to trusted sources via network-level ingress filtering
2. Isolate Discovery Server instances from untrusted networks, since they act as the relay point for leaked memory
3. Monitor for malformed DATA_FRAG traffic (declared sample size far exceeding actual payload length) where deep packet inspection is available

Recommendations for Organizations

• Inventory all systems running eProsima Fast DDS and identify the exact version in use
• Upgrade to the fixed release for your branch (2.6.12 / 2.14.6 / 3.2.4 / 3.3.1 / 3.4.2)
• Audit Discovery Server exposure — restrict RTPS traffic to trusted network segments
• Treat leaked heap pointers as a precursor risk; monitor for follow-on exploitation attempts against DDS-connected systems

Sources

• GitHub Security Advisory — GHSA-7r7h-hwfj-q626
• NVD — CVE-2026-22590
• OffSeq Threat Radar — CVE-2026-22590