CVE-2025-62603

/// Technical description

Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group

). ParticipantGenericMessage is the DDS Security control-message container that carries not only the handshake but also on

going security-control traffic after the handshake, such as crypto-token exchange, rekeying, re-authentication, and token

delivery for newly appearing endpoints. On receive, the CDR parser is invoked first and deserializes the `message_data` (i

.e., the `DataHolderSeq`) via the `readParticipantGenericMessage → readDataHolderSeq` path. The `DataHolderSeq` is parsed

sequentially: a sequence count (`uint32`), and for each DataHolder the `class_id` string (e.g. `DDS:Auth:PKI-DH:1.0+Req`),

string properties (a sequence of key/value pairs), and binary properties (a name plus an octet-vector). The parser operat

es at a stateless level and does not know higher-layer state (for example, whether the handshake has already completed), s

o it fully unfolds the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References