Is CVE-2025-24807 actively exploited?

No active exploitation of CVE-2025-24807 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-24807 be exploited remotely?

No. CVE-2025-24807 requires local access to exploit.

What is the CVSS score of CVE-2025-24807?

CVE-2025-24807 has a CVSS score of 7.1 (HIGH).

HOME VULNERABILITIESCVE-2025-24807

HIGH

CVE-2025-24807

CWE-345Published: February 11, 2025· Updated: Jun 17, 2026

7.1

CVSS v3.1

Official Description

eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.10, 2.10.7, 2.14.5, 3.0.2, 3.1.2, and 3.2.0, per design, PermissionsCA is not full chain validated, nor is the expiration date validated. Access control plugin validates only the S/MIME signature which causes an expired PermissionsCA to be taken as valid. Even though this issue is responsible for allowing `governance/permissions` from an expired PermissionsCA and having the system crash when PermissionsCA is not self-signed and contains the full-chain, the impact is low. Versions 2.6.10, 2.10.7, 2.14.5, 3.0.2, 3.1.2, and 3.2.0 contain a fix for the issue.

NVD Source

Technical Analysis

CVE-2025-24807 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.1.