CVE-2023-39534

    Dashboard / Vulnerabilities / CVE-2023-39534

    CVE-2023-39534

    Published: 11 Aug 2023Last Modified: 12 Aug 2026

    Summary: Malformed GAP submessage triggers assertion failure

    Details: eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0, 2.9.2, and 2.6.5, a malformed GAP submessage can trigger assertion failure, crashing FastDDS. Version 2.10.0, 2.9.2, and 2.6.5 contain a patch for this issue.

    References: https://bombshell.gtisc.gatech.edu/ddsfuzz/pcap/fastdds-assert-230509.pcap, https://github.com/eProsima/Fast-DDS/blob/v2.9.1/include/fastdds/rtps/common/SequenceNumber.h#L238-L252, https://github.com/eProsima/Fast-DDS/blob/v2.9.1/src/cpp/rtps/reader/StatefulReader.cpp#L863, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39534.json, https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-fcr6-x23w-94wp, https://nvd.nist.gov/vuln/detail/CVE-2023-39534, https://www.debian.org/security/2023/dsa-5481

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 7124ff87c4813bed26858fd89d3b915a5857dbc7
    Fixed -8f2a8828dcffab1e78f14023cdae7a8efe4e4a5b

    Affected versions

    2.10.0-rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-39534 | CVE-DB