Integer Underflow in DDS_Security_Deserialize_ methods may lead to OOB read
Priority MEDIUM 46CWE-191Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
An integer underflow during deserialization may allow any unauthenticated user to read out of bounds heap memory. This may result into secret data or pointers revealing the layout of the address space to be included into a deserialized data structure, which may potentially lead to thread crashes or cause denial of service conditions.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00949 61st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Eclipse Cyclone DDS (Eclipse Foundation): 0.10.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Cyclone DDS | before 0.10.5 | 0.10.5 | Patch available | CNA |
- Eclipse Cyclone DDS VendorEclipse Foundation Affected before 0.10.5 Fixed in 0.10.5 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:cyclone_data_distribution_service:*:*:*:*:*:*:*:* | before 0.10.5 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:cyclone_data_distribution_service:*:*:*:*:*:*:*:* Versions before 0.10.5 Vulnerable ·Eclipse Foundation
Remediation
- Fix · CNA Eclipse Cyclone DDS (Eclipse Foundation) Fixed in 0.10.5
Timeline
- 2026-10-02 Threatist record created from CVE-2024-10838
References
More Eclipse Foundation Cyclone Data Distribution Service vulnerabilities
- TI-2025-41132 Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5… CVSS 3.1CRITICAL 10.0
- TI-2020-13455 A heap buffer overflow in /src/dds_stream.c of Eclipse IOT Cyclone DDS Project v0.1.0… CVSS 3.1HIGH 7.5
- TI-2020-13454 A stack buffer overflow in /ddsi/q_bitset.h of Eclipse IOT Cyclone DDS Project v0.1.0… CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences