CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2024-10838: Integer Underflow in DDS_Security_Deserialize_ methods may lead to OOB read
8.8
CVSS
Description
An integer underflow during deserialization may allow any unauthenticated user to read out of bounds heap memory. This may result into secret data or pointers revealing the layout of the address space to be included into a deserialized data structure, which may potentially lead to thread crashes or cause denial of service conditions.
Classification
CVE ID: CVE-2024-10838
CVSS Base Severity: HIGH
CVSS Base Score: 8.8
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Problem Types
CWE-191 Integer Underflow (Wrap or Wraparound)Affected Products
Vendor: Eclipse Foundation
Product: Eclipse Cyclone DDS
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 13.64% (scored less or equal to compared to others)
EPSS Date: 2025-04-10 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2024-10838https://github.com/eclipse-cyclonedds/cyclonedds/security/advisories/GHSA-6jj6-w25p-jc42
https://github.com/eclipse-cyclonedds/cyclonedds/releases/tag/0.10.5
https://gitlab.eclipse.org/security/cve-assignement/-/issues/46