{"id":"CVE-2026-52836","summary":"OpenDDS: out-of-bounds `rd_ptr` dereference in `RtpsSampleHeader::init` — triggered by malformed RTPS submessage, remotely exploitable denial of service","details":"OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). Prior to 3.34.0, a network attacker can crash a reachable OpenDDS participant by sending a malformed RTPS UDP submessage whose crafted length or sequence-number state causes dds/DCPS/transport/rtps_udp/RtpsUdpReceiveStrategy.cpp in RtpsUdpReceiveStrategy::handle_input() to advance ACE_Message_Block::rd_ptr() beyond valid data. The parser can then call dds/DCPS/transport/rtps_udp/RtpsSampleHeader.cpp in RtpsSampleHeader::init(), which dereferences the invalid read pointer without first validating it against wr_ptr() or ensuring that a complete submessage header remains. The resulting SIGSEGV occurs in the receive thread, terminates the DDS process, and destroys the DDS entities hosted by that participant. No authentication, prior protocol state, or victim interaction is required. This issue is fixed in version 3.34.0.","aliases":["GHSA-wcr7-gccq-vv56"],"modified":"2026-10-28T11:16:42.046856266Z","published":"2026-09-17T17:16:26.549Z","database_specific":{"cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52836.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/OpenDDS/OpenDDS/releases/tag/v3.34.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52836.json"},{"type":"ADVISORY","url":"https://github.com/OpenDDS/OpenDDS/security/advisories/GHSA-wcr7-gccq-vv56"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52836"},{"type":"FIX","url":"https://github.com/OpenDDS/OpenDDS/commit/3ded3341e89db88e4c4e09d5153e05730b0a84ce"},{"type":"FIX","url":"https://github.com/OpenDDS/OpenDDS/commit/b46382ebc50d46f933ad6c860a396bffa97adbd7"},{"type":"FIX","url":"https://github.com/OpenDDS/OpenDDS/commit/d6bdddde9ee07f9ee0b461680e5fb64f95cd1251"},{"type":"FIX","url":"https://github.com/OpenDDS/OpenDDS/commit/e5aee3f5b18ee7174d66c3e7818270e1ba2cc2fa"},{"type":"FIX","url":"https://github.com/OpenDDS/OpenDDS/pull/5210"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/opendds/opendds","events":[{"introduced":"0"},{"fixed":"1a9f3ccca65c8933f2698a7cd45a1cef54c64780"},{"fixed":"3ded3341e89db88e4c4e09d5153e05730b0a84ce"},{"fixed":"b46382ebc50d46f933ad6c860a396bffa97adbd7"},{"fixed":"d6bdddde9ee07f9ee0b461680e5fb64f95cd1251"},{"fixed":"e5aee3f5b18ee7174d66c3e7818270e1ba2cc2fa"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"0"},{"fixed":"3.34.0"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"3ded3341e89db88e4c4e09d5153e05730b0a84ce"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"b46382ebc50d46f933ad6c860a396bffa97adbd7"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"d6bdddde9ee07f9ee0b461680e5fb64f95cd1251"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"e5aee3f5b18ee7174d66c3e7818270e1ba2cc2fa"}]},{"range":[{"fixed":"1a9f3ccca65c8933f2698a7cd45a1cef54c64780"}],"source":"REFERENCES_TAG","original_tag":"v3.34.0"}]}}],"versions":["v3.33.0","v3.32.0","green-53","green-48","green-52","v4_start","green-51","green-50","v3.31.0","DDS-3.31","green-49","DDS-3.30","green-47","DDS-3.29","green-46","DDS-3.28","DDS-3.27","green-45","green-44","DDS-3.26","green-43","green-42","green-41","green-40","DDS-3.25","green-39","green-38","DDS-3.24","green-36","green-37","DDS-3.23","green-35","vxworks-pkgs-2210","DDS-3.22","DDS-3.21","DDS-3.20","DDS-3.19","DDS-3.16","DDS-3.18","DDS-3.18-pre1","DDS-3.17-pre22","DDS-3.17","DDS-3.17-pre24","DDS-3.17-pre23","DDS-3.17-pre21","DDS-3.17-pre20","DDS-3.17-pre19","DDS-3.17-pre18","DDS-3.17-pre17","DDS-3.17-pre16","DDS-3.17-pre15","DDS-3.17-pre14","DDS-3.17-pre13","DDS-3.17-pre7","DDS-3.17-pre5","DDS-3.17-pre4","DDS-3.17-pre2","DDS-3.17-pre1","DDS-3.16-pre21","DDS-3.15","DDS-3.15-pre24","DDS-3.15-pre23","DDS-3.14","DDS-3.15-pre22","DDS-3.15-pre21","DDS-3.15-pre20","DDS-3.15-pre18","DDS-3.15-pre19","DDS-3.15-pre17","DDS-3.15-pre16","DDS-3.15-pre13","DDS-3.15-pre14","DDS-3.15-pre15","DDS-3.15-pre12","DDS-3.15-pre11","DDS-3.15-pre10","DDS-3.15-pre9","DDS-3.15-pre8","DDS-3.15-pre7","DDS-3.15-pre6","DDS-3.15-pre5","DDS-3.15-pre4","DDS-3.15-pre3","DDS-3.15-pre2","DDS-3.15-pre1","DDS-3.14-pre5","DDS-3.14-pre4","DDS-3.14-pre3","DDS-3.14-pre2","DDS-3.14-pre1","DDS-3.13","DDS-3.10","DDS-3.12","DDS-3.9","DDS-3.8","DDS-3.7"],"database_specific":{"vanir_signatures_modified":"2026-10-28T11:16:42Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52836.json","vanir_signatures":[{"digest":{"function_hash":"155110850139843775137362178538326008095","length":2860},"id":"CVE-2026-52836-16b105ab","signature_type":"Function","signature_version":"v1","source":"https://github.com/opendds/opendds/commit/d6bdddde9ee07f9ee0b461680e5fb64f95cd1251","target":{"file":"dds/DCPS/transport/rtps_udp/RtpsUdpReceiveStrategy.cpp","function":"RtpsUdpReceiveStrategy::handle_input"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["231422730355549055821599886331981943444","191603916121208114992580434185805448767","122172115648378941591201108116266588405"],"threshold":0.9},"id":"CVE-2026-52836-295a7ae6","signature_type":"Line","signature_version":"v1","source":"https://github.com/opendds/opendds/commit/b46382ebc50d46f933ad6c860a396bffa97adbd7","target":{"file":"dds/DCPS/transport/rtps_udp/RtpsSampleHeader.h"}},{"deprecated":false,"digest":{"line_hashes":["199192012934063223474916466429951321952","337424681740376408290683158488729574743","99087009181171445844098137693024004189","155299781364228194306495193569577148636","117752831473457124904216192035241826303","269768235695573157224205158327459620199","107092863420491397499598938878491124929","170476457812094667841735965745384660339","328601352147712506035325525392308235514","287871307163931919785325690161638963487","105809145584591673628366288589351072236","255656133152029676966213078015266792524","204424439733312343754648513057931884986","136252444770481300176486700724337563602","236411621768802979393306096906102148975","112148796894341833258298706217311991614","150502748227222478836688893551920121551","115793751470678218546580267127532268049","41041418313049299306038788361670481029","225448580863272260349746482782708676840","161611838460064967525609306109711908666","248704049003740535899125626596955791014","207675727501484707582065496419127456913","208224650678160812889519966937124343288","70368474707678578786830837197152312441","145441112607613713936465282756364976748","71316550821225772573020350543119448105","184419297600385075614923105730792380204","237412667698675814684332823543391626195","59939505634202159362853423414782265372"],"threshold":0.9},"id":"CVE-2026-52836-53ef1bba","signature_type":"Line","signature_version":"v1","source":"https://github.com/opendds/opendds/commit/d6bdddde9ee07f9ee0b461680e5fb64f95cd1251","target":{"file":"dds/DCPS/transport/rtps_udp/RtpsUdpReceiveStrategy.cpp"}},{"deprecated":false,"digest":{"line_hashes":["100865665243276182757177307247687064744","108765628340768730937879771384323254967","6165062483374905607749767118229601493","3525329791286126752643391227325898297","221359148735378172032956989628409898601","35208089751072778759695902100326912679","265120807666068465994646664773749976132","232845410974520960256217224486476159459","337909230182662686561374731398284188859","269002740624979157893401210776270335802","96463245760890823615597895337889352118","113116582978891902870733785544116785660","120492492363698249309967118961111091621","87027329248215985246026583698414541039","258713816544068083475168624390354287481","54085923430388624587975721240995213031","22927083184202990891633688502586368718"],"threshold":0.9},"id":"CVE-2026-52836-6829d9c9","signature_type":"Line","signature_version":"v1","source":"https://github.com/opendds/opendds/commit/d6bdddde9ee07f9ee0b461680e5fb64f95cd1251","target":{"file":"dds/DCPS/transport/rtps_udp/RtpsSampleHeader.cpp"}},{"target":{"file":"dds/DCPS/transport/rtps_udp/RtpsUdpReceiveStrategy.cpp","function":"RtpsUdpReceiveStrategy::check_header"},"deprecated":false,"digest":{"function_hash":"307421615253621244483810271524120758818","length":617},"id":"CVE-2026-52836-75ee5493","signature_type":"Function","signature_version":"v1","source":"https://github.com/opendds/opendds/commit/d6bdddde9ee07f9ee0b461680e5fb64f95cd1251"},{"source":"https://github.com/opendds/opendds/commit/d6bdddde9ee07f9ee0b461680e5fb64f95cd1251","target":{"file":"tests/unit-tests/dds/DCPS/transport/rtps_udp/RtpsSampleHeader.cpp"},"deprecated":false,"digest":{"line_hashes":["26570041874987770895202076977379848901","261108393550152761274594331089649620575","326868433292894155168663716490203961721","150659233429475039146977294168892398907"],"threshold":0.9},"id":"CVE-2026-52836-cbaee731","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"305355894957819698526957102521926580747","length":786},"id":"CVE-2026-52836-cc9a63d2","signature_type":"Function","signature_version":"v1","source":"https://github.com/opendds/opendds/commit/d6bdddde9ee07f9ee0b461680e5fb64f95cd1251","target":{"file":"dds/DCPS/transport/rtps_udp/RtpsSampleHeader.cpp","function":"RtpsSampleHeader::init"},"deprecated":false}]}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}