Fast‑DDS is a popular C++ implementation of the DDS standard used in distributed systems; a flaw allows an attacker to craft a DATA_FRAG RTPS submessage with an oversized sampleSize parameter and a small payload, causing the receiver to treat the packet as the last fragment. In that execution path the library calculates an expected data length based on the inflated sampleSize and copies the data into a reassembly buffer without verifying that the actual payload length exceeds this expectation, resulting in an out‑of‑bounds read (CWE‑125) that copies adjacent heap memory into the CacheChange_t structure and exposes sensitive information such as pointer values that can assist in bypassing address‑space layout randomization (CWE‑131); the leak is particularly dangerous in Discovery Server deployments where the corrupted CacheChange_t can be forwarded to new participants, enabling the disclosure of heap contents to newly joining peers.

All eProsima Fast‑DDS installations running versions older than 2.6.12, 2.14.6, 3.2.4, 3.3.1, or 3.4.2 are vulnerable; the issue is present in the core RTPS mesh handling code and affects deployments that use the Discovery Server component which aggregates and forwards cache changes to other participants.

The CVSS score of 9.1 indicates a critical severity, and the vulnerability is remotely triggerable without authentication, allowing an attacker on the same network to craft malicious packets; although the EPSS score is not available, the absence of an assignment in the CISA KEV catalog does not diminish the attack surface—malicious actors can exploit this flaw by sending crafted DATA_FRAG frames over UDP or other transport layers used by DDS, thereby potentially hijacking the discovery process to obtain leaked heap data that may aid further attacks such as code execution.