cve/2023/CVE-2023-42459.md

### [CVE-2023-42459](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42459)
![](https://img.shields.io/static/v1?label=Product&message=Fast-DDS&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3E%3D%202.11.0%2C%20%3C%3D%202.11.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-415%3A%20Double%20Free&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416%3A%20Use%20After%20Free&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-590%3A%20Free%20of%20Memory%20not%20on%20the%20Heap&color=brighgreen)

### Description

Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). In affected versions specific DATA submessages can be sent to a discovery locator which may trigger a free error. This can remotely crash any Fast-DDS process. The call to free() could potentially leave the pointer in the attackers control which could lead to a double free. This issue has been addressed in versions 2.12.0, 2.11.3, 2.10.3, and 2.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

### POC

#### Reference
- https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-gq8g-fj58-22gm

#### Github
No PoCs found on GitHub currently.