PT-2025-11036 · Eclipse Foundation+3 · Eclipse Cyclonedds+2

Robert Femmer + 1 · Published 2025-03-12 · Updated 2025-03-14 · CVE-2024-10838

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined.

Description: An integer underflow during deserialization may allow any unauthenticated user to read out of bounds heap memory, potentially leading to the inclusion of secret data or pointers that reveal the layout of the address space into a deserialized data structure. This could result in thread crashes or denial of service conditions. Unauthenticated users could exploit this issue to access sensitive data or crash threads.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2024-10838

GHSA-6JJ6-W25P-JC42

Affected Products

Eclipse Cyclonedds

Cyclone Data Distribution Service

Cyclonedds

References · 11

• 🔥 https://github.com/eclipse-cyclonedds/cyclonedds/security/advisories/GHSA-6jj6-w25p-jc42 · Exploit
• https://github.com/eclipse-cyclonedds/cyclonedds/releases/tag/0.10.5 · Patch
• https://gitlab.eclipse.org/security/cve-assignement/-/issues/46 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-10838 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10838 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-10838 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-10838 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-10838 · Security Note
• https://twitter.com/CveFindCom/status/1899815518678159848 · Twitter Post
• https://twitter.com/cybercronai/status/1900351686499086402 · Twitter Post
• https://twitter.com/CVEnew/status/1899894917717254524 · Twitter Post