CVE-2023-42459: eprosima fast dds

csirt@kutim:~/threat-intel/cve/CVE-2023-42459

CVSS 7.5 · High EPSS 0,83%

Kerentanan Double Free pada eprosima fast dds. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). In affected versions specific DATA submessages can be sent to a discovery locator which may trigger a free error. This can remotely crash any Fast-DDS process. The call to free() could potentially leave the pointer in the attackers control which could lead to a double free. This issue has been addressed in versions 2.12.0, 2.11.3, 2.10.3, and 2.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD: 16 Oktober 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-415: Double Free
CWE-416: Use After Free
CWE-590: Free of Memory not on the Heap
EPSS (30 hari): 0,83% peluang dieksploitasi; lebih tinggi dari 56,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
eprosima	fast dds	Semua versi sebelum 2.6.7
eprosima	fast dds	Versi 2.10.0 hingga sebelum 2.10.3
eprosima	fast dds	Versi 2.11.0 hingga 2.11.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-gq8g-fj58-22gm advisory vendor
https://github.com/eProsima/Fast-DDS/pull/3824 patch
https://github.com/eProsima/Fast-DDS/issues/3207 exploit · issue tracking
https://www.debian.org/security/2023/dsa-5568 mailing list

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.