An attacker can send a malicious packet that modifies the MTU length field, causing the Eprosima Micro‑XRCE‑DDS Agent to drop packets or enter an error state. This results in a denial of service that affects only the targeted agent instance. The weakness is a failure to validate input length fields, allowing crafted data to disrupt normal operation. Based on the description, it is inferred that the attack vector is over the network via a crafted packet.

Eprosima Micro‑XRCE‑DDS Agent version 3.0.1 is affected. No other vendors or products are listed, and the vulnerability is specific to this release.

The vulnerability is remote, as a crafted packet can be sent over the network to the agent. CVSS score of 7.5 and EPSS not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that there are no known public exploits yet. Nonetheless, in an environment where the agent is exposed to untrusted networks, the risk of a local or remote denial of service could interrupt operations or render a critical messaging endpoint unavailable.