CVE-2023-39948

    Dashboard / Vulnerabilities / CVE-2023-39948

    CVE-2023-39948

    Published: 11 Aug 2023Last Modified: 12 Aug 2026

    Summary: Uncaught fastcdr exception (Unexpected CDR type received) crashing fastdds

    Details: eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.10.0 and 2.6.5, the `BadParamException` thrown by Fast CDR is not caught in Fast DDS. This can remotely crash any Fast DDS process. Versions 2.10.0 and 2.6.5 contain a patch for this issue.

    References: https://github.com/eProsima/Fast-DDS/files/11117197/fastdds-assert.pcap.zip, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39948.json, https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-x9pj-vrgf-f68f, https://nvd.nist.gov/vuln/detail/CVE-2023-39948, https://www.debian.org/security/2023/dsa-5481, https://github.com/eProsima/Fast-DDS/issues/3422

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 7124ff87c4813bed26858fd89d3b915a5857dbc7
    Fixed -8f2a8828dcffab1e78f14023cdae7a8efe4e4a5b

    Affected versions

    2.10.0-rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-39948 | CVE-DB