Vulnerability · Published Mar 12, 2025 · Assigned by eclipse
CVE-2024-10838Integer Underflow in DDS_Security_Deserialize_ methods may lead to OOB read
High 8.8
In plain English
A high-severity security flaw in Eclipse Cyclone DDS from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Official description
An integer underflow during deserialization may allow any unauthenticated user to read out of bounds heap memory. This may result into secret data or pointers revealing the layout of the address space to be included into a deserialized data structure, which may potentially lead to thread crashes or cause denial of service conditions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | cyclonedds | no fix listed | UBUNTU-CVE-2024-10838 |
| Ubuntu:24.04:LTS | cyclonedds | no fix listed | UBUNTU-CVE-2024-10838 |
| Ubuntu:25.10 | cyclonedds | no fix listed | UBUNTU-CVE-2024-10838 |
| Ubuntu:26.04:LTS | cyclonedds | no fix listed | UBUNTU-CVE-2024-10838 |
| Ubuntu:26.10 | cyclonedds | no fix listed | UBUNTU-CVE-2024-10838 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Eclipse Cyclone DDS | 0 – before 0.10.5 |
Weakness: CWE-191 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N