Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Loading CVE intelligence

Loading vulnerability catalog

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

CVE-2024-28231

CriticalPublished

Manipulated DATA Submessage causes a heap-buffer-overflow error

Published: Mar 20, 2024
Updated: Aug 2, 2024
Assigning CNA: GitHub_M
Evidence observed: Aug 8, 2026

Primary CVSS

9.6/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS probability estimate

0.9%

Low · next 30 days

Percentile: 58.9%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.14.0, 2.13.4, 2.12.3, 2.10.4, and 2.6.8, manipulated DATA Submessage can cause a heap overflow error in the Fast-DDS process, causing the process to be terminated remotely. Additionally, the payload_size in the DATA Submessage packet is declared as uint32_t. When a negative number, such as -1, is input into this variable, it results in an Integer Overflow (for example, -1 gets converted to 0xFFFFFFFF). This eventually leads to a heap-buffer-overflow, causing the program to terminate. Versions 2.14.0, 2.13.4, 2.12.3, 2.10.4, and 2.6.8 contain a fix for this issue.

Sources

ros2_CVE-2024-28231PoC
Demonstrating the usage of Fastrtps-DDS vulnerability CVE-2024-28231 within Ros2

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.