EUVD-2026-84618
GHSA-366x-7vgf-6pg3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged access
-
ExploitSupply crafted input to Connext Core Library
-
ExecutionTrigger out-of-bounds buffer over-read
-
ImpactCrash DDS process (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires LOCAL access to a host running RTI Connext Professional plus valid low-level privileges (AV:L/PR:L) - this is not remotely exploitable and needs no user interaction. Affected versions span 7.4.0 before 7.7.0.1, 7.0.0 before 7.3.1.6, and the 6.1.x, 6.0.x, 5.3.x, 5.2.x, and 5.0.0-5.1.x branches; hosts on fixed builds (7.7.0.1 / 7.3.1.6 or later patched branches) are not exposed. The limiting factors - local vector, required authentication/privileges, and availability-only outcome (no confidentiality or integrity impact) - substantially constrain realistic risk to insider or already-foothold scenarios causing service disruption. |
| Impact | This is a moderate-severity, availability-only local DoS, not a high-priority remotely-exploitable flaw. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H, score 6.8) confirms LOCAL attack vector with low privileges required and impact limited strictly to availability (VC:N/VI:N/VA:H) - despite the 'Information Disclosure' tag, there is NO confidentiality impact per the vector, so an out-of-bounds READ here manifests as a crash/DoS, not data leakage. There is no EPSS score, no CISA KEV listing, and no public POC identified - exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent (local, authed, availability-only) with the one exception that the 'Information Disclosure' tag conflicts with VC:N; the tag is misleading and should be treated as DoS. Real-world priority is LOW-to-MODERATE: local access plus valid low privileges are already required, the affected product is niche middleware, and the only outcome is denial of service to a Connext process. This is a patch-in-normal-cycle issue, not an emergency. |
| Exploit ScenarioDerived | A local attacker who already holds low-privilege access on a host running RTI Connext Professional supplies crafted input to a Core Library component that triggers an out-of-bounds read, causing the DDS process to over-read a buffer and crash. No public exploit code is available, and the attack yields only denial of service (no data disclosure or code execution per the CVSS vector), so impact is limited to disrupting the availability of the affected middleware. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Out-of-bounds read in the Core Libraries of RTI Connext Professional allows a locally positioned attacker with low-level privileges on a host running the middleware to trigger an overread that can crash or destabilize the affected process, producing a denial-of-service condition. Affected builds span 7.4.0 before 7.7.0.1, 7.0.0 before 7.3.1.6, and the 6.1.x, 6.0.x, 5.3.x, 5.2.x and 5.0.0-5.1.x branches; systems already on the fixed builds are not exposed. The impact is availability-only with no confidentiality or integrity effect, and because the attack requires local access and valid credentials rather than network reachability, realistic exposure is limited to insider or already-foothold scenarios causing service disruption. No public exploit code and no confirmed active exploitation were identified at time of analysis.
RemediationAI
Vendor-released patches are available: upgrade to 7.7.0.1 for the 7.4.x/7.5.x/7.6.x line or to 7.3.1.6 for the 7.0.x line, and move to the current patched release in the 6.1.x, 6.0.x, 5.3.x, 5.2.x or 5.0-5.1.x branches as listed in the RTI advisory at https://www.rti.com/vulnerabilities/#cve-2026-18626. No public exploit code or confirmed active exploitation has been identified, so patching can follow normal maintenance windows rather than emergency change control. Because the vulnerability is local (AV:L) and requires low-level privileges (PR:L), the highest-value compensating controls target host access rather than the network: restrict interactive and service-account access on machines hosting Connext applications to trusted and audited users, run the middleware under a dedicated least-privilege service account so that unrelated local accounts cannot reach the vulnerable parsing paths, and apply OS-level hardening (SELinux/AppArmor profiles, seccomp filters, or containers) to contain the process if it is abused - accepting that aggressive sandboxing can interfere with shared-memory transports and inter-process communication used by DDS peers. Where patching is delayed, monitor for repeated abnormal termination of Connext processes as an indicator of attempted or accidental triggering, and note that because the assessed impact is availability-only, no data-exfiltration-specific monitoring is warranted.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-125 (Out-of-bounds Read) within the Core Libraries of RTI Connext Professional, a commercial DDS (Data Distribution Service) middleware used for real-time publish/subscribe data exchange in industrial, aerospace, defense and medical systems. An overread occurs when a buffer length or offset derived from parsed input is not validated against the actual size of the allocated buffer, causing the library to read past the end of the region; depending on memory layout this can result in an access violation and abnormal process termination. The single CPE string cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:* identifies RTI Connext Professional as the affected product family without narrowing to a specific platform, consistent with a defect in shared core library code. Vendor scoring with CVSS v4.0 is 6.8, and the independent assessment using CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H agrees on the essential characteristics: the vector is local, requires low privileges, needs no user interaction, and affects only availability - the confidentiality and integrity metrics are explicitly None, so the overread is not assessed as an information-disclosure primitive despite the buffer-overread mechanics. The reported by-line (RTI) and the CWE classification therefore point to a robustness/DoS defect in input handling rather than a memory-corruption path leading to code execution.
Know when Connext Professional gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Local vector and low privileges per vendor (AV:L/PR:L); out-of-bounds read causes a crash so A:H with C:N/I:N, matching the availability-only impact.
Primary rating from Vendor (RTI).
CVSS VectorVendor: RTI
Lifecycle Timeline
1DescriptionCVE.org
Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, from 5.0.0 before 5.1.*.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
More in Connext Professional
View allA stack-based buffer overflow in the RTI Connext Professional Core Libraries lets a remote, unauthenticated attacker cor
Remote heap-based buffer overflow in RTI Connext Professional Core Libraries allows unauthenticated network attackers to
Out-of-bounds read in RTI Connext Professional Core Libraries allows remote unauthenticated attackers to read beyond int
Format-string injection in RTI Connext Professional Core Libraries (versions 7.5.0 before 7.7.0.1 and 7.3.0.10 before 7.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RTI Connext Profes
Remote denial of service and partial data exposure in RTI Connext Professional's Web Integration Service results from a
XML External Entity (XXE) injection in RTI Connext Professional's Core Libraries allows remote unauthenticated attackers
XML External Entity (XXE) injection in RTI Connext Professional routing and service components allows remote unauthentic
Remote, unauthenticated attackers who can reach the DDS/RTPS data bus of an application built on RTI Connext Professiona
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in RTI Connext
Untrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation.4.0
Untrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation.4.0
Exploit-DB