CVE-2023-39946

Summary

CVE-2023-39946 is a vulnerability affecting eprosima Fast DDS, a C++ implementation of the Data Distribution Service standard. Prior to versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6, this software is susceptible to a heap overflow. The issue arises when processing a PID_PROPERTY_LIST parameter containing a maliciously crafted CDR string with a length larger than the actual content. In `eprosima::fastdds::dds::ParameterPropertyList_t::push_back_helper`, both the `data` and `size` parameters can be controlled by an attacker in the second `memcpy` call. This can result in a remote denial-of-service (DoS) attack, causing any Fast-DDS process to crash. Versions 2.11.1, 2.10.2, 2.9.2, and 2.6.6 have been patched to address this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.