The vulnerability is an Improper Input Validation flaw in the gazebo_ros_diff_drive.cpp source of Gazebo Plugins version 3.9.0. An attacker can craft a geometry_msgs::Twist message whose values exceed the limits the plugin expects. When such a message is published to the /cmd_vel topic the differential‑wheel robot simulation process aborts or stops responding, effectively denying service to the simulated robot.

Any ROS‑based robotic simulation that uses the gazebo_ros_diff_drive plug‑in from Gazebo Plugins 3.9.0 is susceptible. The flaw resides solely in the plug‑in logic and is independent of the host operating system. Systems that publish geometry_msgs::Twist messages to the /cmd_vel topic, whether locally or over a network, must verify the plug‑in version in use.

The CVSS score of 7.5 indicates a moderately high impact while the EPSS score of less than 1% reflects a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only the ability to publish a crafted Twist message to /cmd_vel; authentication or privileged access is not necessary, so a local or network attacker that can reach this topic could trigger the denial of service.