CVE-2026-52836

Overview

OpenDDS prior to version 3.34.0 contains a vulnerability in the RTPS UDP transport receive strategy where a malformed submessage causes an invalid read pointer dereference. A network-based attacker can exploit this flaw to trigger a SIGSEGV, resulting in a crash of the targeted DDS participant process. The vulnerability matters because it allows unauthenticated remote attackers to cause a denial of service against critical messaging infrastructure.

Description

OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). Prior to 3.34.0, a network attacker can crash a reachable OpenDDS participant by sending a malformed RTPS UDP submessage whose crafted length or sequence-number state causes dds/DCPS/transport/rtps_udp/RtpsUdpReceiveStrategy.cpp in RtpsUdpReceiveStrategy::handle_input() to advance ACE_Message_Block::rd_ptr() beyond valid data. The parser can then call dds/DCPS/transport/rtps_udp/RtpsSampleHeader.cpp in RtpsSampleHeader::init(), which dereferences the invalid read pointer without first validating it against wr_ptr() or ensuring that a complete submessage header remains. The resulting SIGSEGV occurs in the receive thread, terminates the DDS process, and destroys the DDS entities hosted by that participant. No authentication, prior protocol state, or victim interaction is required. This issue is fixed in version 3.34.0.

Impact

This vulnerability impacts availability by causing unauthenticated denial of service against systems running affected OpenDDS versions. Confidentiality and integrity are not directly impacted, but application availability is entirely disrupted when the process crashes. Defenders running reachable OpenDDS participants are directly at risk of unexpected process termination and loss of hosted DDS entities.

Remediation

Upgrade OpenDDS to version 3.34.0 or later where the pointer validation logic has been corrected. If upgrading immediately is not possible, restrict network access to OpenDDS endpoints using firewalls or network segmentation to prevent untrusted traffic from reaching vulnerable participants.

Risk context

The vulnerability carries a high CVSS v4 score of 8.7 and a CVSS v3 score of 6.5, indicating significant potential impact on availability. However, the current EPSS score of 0.00016 suggests that active exploitation in the wild is currently very low. Urgency is moderate to high depending on network exposure and the criticality of the targeted messaging infrastructure.

Affected products

• OpenDDS < 3.34.0