CVE-2024-10838 json
Integer Underflow in DDS_Security_Deserialize_ methods may lead to OOB read
published 2025-03-12 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-54131
- cvss
- 9.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 61%
- public exploits
- 0
- none known
Summary
An integer underflow during deserialization may allow any unauthenticated user to read out of bounds heap memory. This may result into secret data or pointers revealing the layout of the address space to be included into a deserialized data structure, which may potentially lead to thread crashes or cause denial of service conditions.
Patch / fix
- Eclipse Foundation Eclipse Cyclone DDS 0.10.5
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.95% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/eclipse-cyclonedds/cyclonedds/security/advisories/GHSA-6jj6-w25p-jc42 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
Affected products
- Eclipse Foundation Eclipse Cyclone DDS
Classification
- Weakness
-
- CWE-191 Integer Underflow (Wrap or Wraparound)
References
-
github.com
/eclipse-cyclonedds/cyclonedds/releases/tag/0.10.5
patch
-
github.com
/eclipse-cyclonedds/cyclonedds/security/advisories/GHSA-6jj6-w25p-jc42
exploit, vendor-advisory
-
gitlab.eclipse.org
/security/cve-assignement/-/issues/46
issue-tracking, vendor-advisory
Sources
- CVE List CVE-2024-10838
- NVD CVE-2024-10838
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.