CVE-2026-52836
OpenDDS: out-of-bounds `rd_ptr` dereference in `RtpsSampleHeader::init` — triggered by malformed RTPS submessage, remotely exploitable denial of service
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). Prior to 3.34.0, a network attacker can crash a reachable OpenDDS participant by sending a malformed RTPS UDP submessage whose crafted length or sequence-number state causes dds/DCPS/transport/rtps_udp/RtpsUdpReceiveStrategy.cpp in RtpsUdpReceiveStrategy::handle_input() to advance ACE_Message_Block::rd_ptr() beyond valid data. The parser can then call dds/DCPS/transport/rtps_udp/RtpsSampleHeader.cpp in RtpsSampleHeader::init(), which dereferences the invalid read pointer without first validating it against wr_ptr() or ensuring that a complete submessage header remains. The resulting SIGSEGV occurs in the receive thread, terminates the DDS process, and destroys the DDS entities hosted by that participant. No authentication, prior protocol state, or victim interaction is required. This issue is fixed in version 3.34.0.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 4.0 | High8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| NVDNVD · Awaiting Analysis | 4.0 | High8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.74% · top 45% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.
Weakness
Affected products
References (7)
- https://github.com/OpenDDS/OpenDDS/security/advisories/GHSA-wcr7-gccq-vv56 (opens in a new tab)x_refsource_CONFIRM
- https://github.com/OpenDDS/OpenDDS/pull/5210 (opens in a new tab)x_refsource_MISC
- https://github.com/OpenDDS/OpenDDS/commit/3ded3341e89db88e4c4e09d5153e05730b0a84ce (opens in a new tab)x_refsource_MISC
- https://github.com/OpenDDS/OpenDDS/commit/b46382ebc50d46f933ad6c860a396bffa97adbd7 (opens in a new tab)x_refsource_MISC
- https://github.com/OpenDDS/OpenDDS/commit/d6bdddde9ee07f9ee0b461680e5fb64f95cd1251 (opens in a new tab)x_refsource_MISC
- https://github.com/OpenDDS/OpenDDS/commit/e5aee3f5b18ee7174d66c3e7818270e1ba2cc2fa (opens in a new tab)x_refsource_MISC
- https://github.com/OpenDDS/OpenDDS/releases/tag/v3.34.0 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-52836)Record last updated .