CVE-2023-42459

Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). In affected versions specific DATA submessages can be sent to a discovery locator which may trigger a free error. This can remotely crash any Fast-DDS process. The call to free() could potentially leave the pointer in the attackers control which could lead to a double free. This issue has been addressed in versions 2.12.0, 2.11.3, 2.10.3, and 2.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-415
• CWE-416
• CWE-590
• CWE-415

• https://github.com/eProsima/Fast-DDS/issues/3207Exploit, Issue Tracking
• https://github.com/eProsima/Fast-DDS/pull/3824Patch
• https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-gq8g-fj58-22gmVendor Advisory
• https://www.debian.org/security/2023/dsa-5568Mailing List
• https://github.com/eProsima/Fast-DDS/issues/3207Exploit, Issue Tracking
• https://github.com/eProsima/Fast-DDS/pull/3824Patch
• https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-gq8g-fj58-22gmVendor Advisory
• https://www.debian.org/security/2023/dsa-5568Mailing List

Published

Oct 16, 2023

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42453Synapse is an open-source Matrix homeserver written and main…4.3
• CVE-2023-42454SQLpage is a SQL-only webapp builder. Someone using SQLpage …9.1
• CVE-2023-42455Wazuh is a security detection, visibility, and compliance op…8.8
• CVE-2023-42456Sudo-rs, a memory safe implementation of sudo and su, allows…8.1
• CVE-2023-42457plone.rest allows users to use HTTP verbs such as GET, POST,…7.5
• CVE-2023-42458Zope is an open-source web application server. Prior to vers…5.4
• CVE-2023-4246The GiveWP plugin for WordPress is vulnerable to Cross-Site …4.3
• CVE-2023-42460Vyper is a Pythonic Smart Contract Language for the EVM. The…7.5
• CVE-2023-42461GLPI stands for Gestionnaire Libre de Parc Informatique is a…9.8
• CVE-2023-42462GLPI stands for Gestionnaire Libre de Parc Informatique is a…9.1
• CVE-2023-42463Wazuh is a free and open source platform used for threat pre…7.8
• CVE-2023-42464A Type Confusion vulnerability was found in the Spotlight RP…9.8