CVE-2025-67111

An integer overflow in the RTPS protocol implementation of OpenDDS DDS before v3.33.0 allows attackers to cause a Denial of Service (DoS) via a crafted message

High · published December 23, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
26.9
In the wild
Unconfirmed
What it is

⚡ A crafty message can bring your entire system to its knees! An integer overflow in OpenDDS DDS before v3.33.0 opens the door for a Denial of Service attack. 🔥 Think of it like a restaurant that overbooks tables. One too many reservation requests lead to overflowing chaos, leaving customers waiting or turned away entirely, just like a crafted message can overwhelm the system. The impact here is pretty severe! An attacker could send a specially crafted message that causes the DDS to crash, resulting in a complete Denial of Service. This means your applications could become unresponsive, disrupting operations and frustrating users.

Put simply

Think of it like a restaurant that overbooks tables. One too many reservation requests lead to overflowing chaos, leaving customers waiting or turned away entirely, just like a crafted message can overwhelm the system. This vulnerability arises from an integer overflow in the RTPS protocol implementation, which allows attackers to craft messages that exceed the expected size, eventually causing the service to crash.

What to do

The impact here is pretty severe! An attacker could send a specially crafted message that causes the DDS to crash, resulting in a complete Denial of Service. This means your applications could become unresponsive, disrupting operations and frustrating users. To protect your system, upgrade to OpenDDS DDS v3.33.0 or later immediately. Additionally, monitor your systems for any unusual message patterns that may indicate attempted exploitation. Implement rate limiting to manage incoming message traffic more effectively. You've got this! By patching up and staying vigilant, you'll keep your systems running smoothly! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00346 · 26.9th percentile
Published
2025-12-23T00:00Z
EPSS history
Timeline
  • 23 DEC 00:00Z
    An integer overflow in the RTPS protocol implementation of OpenDDS DDS before v3.33.0 allows attackers to cause a Denial of Service (DoS) via a crafted message
    cvelistv5