CVE-2023-39945

    Dashboard / Vulnerabilities / CVE-2023-39945

    CVE-2023-39945

    Published: 11 Aug 2023Last Modified: 12 Aug 2026

    Summary: Malformed serialized data in a data submessage leads to unhandled exception

    Details: eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.11.0, 2.10.2, 2.9.2, and 2.6.5, a data submessage sent to PDP port raises unhandled `BadParamException` in fastcdr, which in turn crashes fastdds. Versions 2.11.0, 2.10.2, 2.9.2, and 2.6.5 contain a patch for this issue.

    References: https://bombshell.gtisc.gatech.edu/ddsfuzz/pcap/fastdds-exception-20230509-02.pcap, https://github.com/eProsima/Fast-CDR/blob/v1.0.26/src/cpp/Cdr.cpp#L72-L79, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39945.json, https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-2rq6-8j7x-frr9, https://nvd.nist.gov/vuln/detail/CVE-2023-39945, https://www.debian.org/security/2023/dsa-5481

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 7124ff87c4813bed26858fd89d3b915a5857dbc7
    Fixed -8f2a8828dcffab1e78f14023cdae7a8efe4e4a5b

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-39945 | CVE-DB