A heap out‑of‑bounds write occurs in the Nav2 AMCL particle filter clustering logic when an attacker publishes a PoseWithCovarianceStamped message to the /initialpose topic containing extreme covariance values. The malicious message causes the filtering code to compute a negative index and write before the allocated buffer, corrupting the heap chunk metadata. This primitive can be leveraged to overwrite protected heap fields and potentially lead to remote code execution; at minimum the flaw causes a reliable denial of service by killing localization and halting navigation.

Version 1.3.11 and earlier of the ROS 2 Navigation Framework (navigation2) from the vendor ros-navigation are affected. Users operating these releases on a ROS 2 DDS domain that allows publishing to /initialpose are in scope.

The vulnerability has a CVSS base score of 9.3, indicating critical severity. The EPSS score is below 1%, suggesting that industrial exploitation is currently unlikely, and the issue is not listed in CISA’s KEV catalog. However, the attack vector requires that the attacker has network access to the same ROS 2 DDS domain and can publish to /initialpose; no authentication is required. Release builds compile out the only boundary check (an assert), leaving zero runtime protection. The described corruption of heap metadata provides a foothold for adversaries to achieve remote code execution, but even without that, the uncontrolled write results in a deterministic denial of service that stops all navigation processes.