CVE-2023-39947

What it actually does

Malformed PID_PROPERTY_LIST parameters in RTPS messages trigger a heap overflow at a secondary program counter, resulting in remote denial of service via process crash.

Why it matters to the business

Remote attackers can crash any Fast DDS instance, disrupting real-time publish-subscribe data flows in robotics, autonomous systems, and industrial control environments; the issue has been public for over three years with no observed exploitation.

How an attack unfolds

An attacker crafts a network packet containing an invalid PID_PROPERTY_LIST parameter and sends it to a listening Fast DDS participant; the library parses the malformed list, overflows a heap buffer, and terminates the process.

How to fix it

Upgrade eprosima/fast-dds to version 2.11.1, 2.10.2, 2.9.2, or 2.6.6 (commit cffaa679ec8cd9c84b4d5b3fe1e3c22974d63be0 or later).

How to confirm the fix worked

Confirm the running binary or library reports one of the patched versions; replay a test vector containing the malformed PID_PROPERTY_LIST against a non-production instance and verify it no longer crashes.

Typical attack path

1. Locate exposed Fast DDS endpoints via network discovery
2. Transmit a single RTPS message containing a crafted PID_PROPERTY_LIST
3. Trigger heap overflow during parameter processing
4. Cause immediate process termination

How to detect it

Review process crash dumps and application logs for heap-related faults during RTPS message handling; inspect network captures for RTPS packets with unusual PID_PROPERTY_LIST lengths or contents.

What your security team should do

• Immediately upgrade all Fast DDS deployments to a patched release
• Restrict inbound RTPS traffic to trusted sources until upgrades are complete
• Monitor application logs and process health for unexpected terminations
• Add network-level filtering for anomalous RTPS parameter lengths if upgrades are delayed