CVE-2026-52836: OpenDDS: out-of-bounds `rd_ptr` dereference in `RtpsSampleHeader::init` — triggered by malformed RTPS submessage, remotely exploitable denial of service
OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). Prior to 3.34.0, a network attacker can crash a reachable OpenDDS participant by sending a malformed RTPS UDP submessage whose crafted length or sequence-number state causes dds/DCPS/transport/rtpsudp/RtpsUdpReceiveStrategy.cpp in RtpsUdpReceiveStrategy::handleinput() to advance ACEMessageBlock::rdptr() beyond valid data. The parser can then call dds/DCPS/transport/rtpsudp/RtpsSampleHeader.cpp in RtpsSampleHeader::init(), which dereferences the invalid read pointer without first validating it against wrptr() or ensuring that a complete submessage header remains. The resulting SIGSEGV occurs in the receive thread, terminates the DDS process, and destroys the DDS entities hosted by that participant. No authentication, prior protocol state, or victim interaction is required. This issue is fixed in version 3.34.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenDDSto a version that resolves this vulnerability.Fixed in 3.34.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
OpenDDS participants running a version before 3.34.0 are exposed if they are reachable by an attacker over RTPS UDP. A successful attack crashes the participant's DDS process and destroys the DDS entities it hosts.
What does an attacker need to exploit it?
The attacker only needs to send a malformed RTPS UDP submessage with crafted length or sequence-number state to a reachable participant. Authentication, prior protocol state, and victim interaction are not required.
Are unpatched deployments affected without special configuration?
The issue is in RTPS UDP message handling, and the provided information does not identify any non-default setting required for exploitation. Any reachable vulnerable participant processing attacker-supplied RTPS UDP traffic should be treated as exposed.
What is the available remediation?
Upgrade OpenDDS to version 3.34.0, which fixes the issue.