How severe is CVE-2025-67108?

CVE-2025-67108 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2025-67108 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-67108?

CVE-2025-67108 affects Eprosima Fast Dds. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-67108?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2025-67108 have an EU (EUVD) identifier?

Yes. CVE-2025-67108 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-204854.

When was CVE-2025-67108 published?

CVE-2025-67108 was published on 2025-12-23 and last updated on 2026-07-05.

CVE-2025-67108

CVE-2025-67108 is a critical-severity vulnerability in Eprosima Fast Dds with a CVSS 3.x base score of 10.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-298.

Key facts

Severity: Critical (CVSS 3.x base score 10.0)
EPSS exploit prediction: 0% (17th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-204854
Weakness: CWE-298
Affected product: Eprosima Fast Dds
Published: 2025-12-23
Last modified: 2026-07-05

Description

eProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket revocation, resulting in insecure communications and connections.

Frequently asked questions

What is CVE-2025-67108?: eProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket revocation, resulting in insecure communications and connections.
How severe is CVE-2025-67108?: CVE-2025-67108 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2025-67108 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-67108?: CVE-2025-67108 affects Eprosima Fast Dds. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-67108?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-67108 have an EU (EUVD) identifier?: Yes. CVE-2025-67108 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-204854.
When was CVE-2025-67108 published?: CVE-2025-67108 was published on 2025-12-23 and last updated on 2026-07-05.

References

EU advisories (EUVD)

Affected products (1)

cpe:2.3:a:eprosima:fast_dds:3.3.0:*:*:*:*:*:*:*

More vulnerabilities in Eprosima Fast Dds

CVE-2025-62799 — Critical (CVSS 9.8): Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ).…
CVE-2024-28231 — Critical (CVSS 9.6): eprosima Fast DDS is a C++ implementation of the Data Distribution Service standard of the Object Management Group.…
CVE-2023-50716 — Critical (CVSS 9.6): eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object…
CVE-2023-50257 — Critical (CVSS 9.6): eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object…
CVE-2025-62600 — High (CVSS 8.6): eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management…
CVE-2025-62599 — High (CVSS 8.6): eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management…

All CVEs affecting Eprosima Fast Dds →

Other CWE-298 vulnerabilities

CVE-2025-67109 — Critical (CVSS 10.0): Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass…
CVE-2025-61736 — High (CVSS 7.1): Successful exploitation of this vulnerability could result in the product failing to re-establish communication once…
CVE-2025-4384 — Medium (CVSS 6.0): The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet…
CVE-2025-59036 — Medium (CVSS 5.5): Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the…
CVE-2024-1248 — Medium (CVSS 4.8): The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly…

Browse all CWE-298 vulnerabilities →