Which versions of RTI Connext Professional are affected by CVE-2026-2467?

RTI Connext Professional Core Libraries, a critical DDS middleware used across industrial and enterprise infrastructure, contains a remote heap overflow vulnerability allowing unauthenticated network…

How to fix or mitigate CVE-2026-2467?

Within 24 hours: Conduct comprehensive audit of all RTI Connext Professional installations across infrastructure using asset inventory and software scanning tools; identify all systems running versions 5.0.x through 7.6.x. Within 7 days: Implement network segmentation to isolate RTI Connext systems from untrusted networks; enable detailed logging and monitoring for abnormal DDS protocol traffic; contact RTI support to confirm patch availability timeline. Within 30 days: Evaluate migration paths to patched RTI Connext versions when released; if patches unavailable, assess architectural alternatives to reduce exposure of critical systems to untrusted networks; validate all compensating controls.

RTI Connext Professional CVE-2026-2467

Q: What is the CVSS score of CVE-2026-2467?

CVE-2026-2467 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-06-17 RTI

Heap Overflow Buffer Overflow Connext Professional

9.2

CVSS 4.0 · Vendor: RTI

Severity by source

Vendor (RTI) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.3 CRITICAL

Network-reachable RTPS parser with no auth or interaction (AV:N/AC:L/PR:N/UI:N); scope changed because the subsequent DDS domain is affected (SA:H), no confidentiality impact, integrity low, availability high.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H

Primary rating from Vendor (RTI).

CVSS VectorVendor: RTI

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 18:05 vuln.today

DescriptionCVE.org

Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.3, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.0.0 before 5.2.*.

AnalysisAI

Remote heap-based buffer overflow in RTI Connext Professional Core Libraries allows unauthenticated network attackers to corrupt heap memory in the DDS middleware, impacting integrity and availability of both the vulnerable component and downstream subsystems. The flaw spans a wide range of long-supported branches (5.0.x through 7.6.x) and carries a CVSS 4.0 score of 9.2, though no public exploit identified at time of analysis.

Technical ContextAI

RTI Connext Professional is a commercial implementation of the OMG Data Distribution Service (DDS) standard, widely used as the real-time publish/subscribe messaging middleware in defense, aerospace, autonomous vehicles, robotics, medical devices, and industrial control systems. The defect resides in the Core Libraries - the shared runtime that handles RTPS (Real-Time Publish-Subscribe) wire protocol parsing, discovery, and serialization for DDS participants. CWE-122 (heap-based buffer overflow) here is described as 'Overflow Variables and Tags', indicating that parsing of variably-sized fields or tagged elements in incoming DDS/RTPS traffic fails to validate length against the allocated heap buffer, enabling out-of-bounds heap writes that can corrupt adjacent control structures.

RemediationAI

Patch available per vendor advisory - upgrade Connext Professional to a fixed release on the relevant branch: 7.7.0 or later for the 7.4.x-7.6.x line, and 7.3.1.3 or later for the 7.0.x-7.3.x line, per the RTI advisory at https://www.rti.com/vulnerabilities/#cve-2026-2467; for the legacy 6.1.x, 6.0.x, 5.3.x, and 5.0.x-5.2.x branches, consult RTI directly since fixed point releases for those long-term-support trains must be confirmed with the vendor and may require a support contract. Until upgrade, restrict DDS domain reachability by binding RTPS discovery and user-data traffic to dedicated VLANs or loopback interfaces and blocking the configured RTPS UDP/TCP ports (default UDP 7400-range and any user-configured ports) at network boundaries - the trade-off is that cross-host DDS participants must remain reachable on the trusted segment, so segmentation must align with the data-flow topology. Enabling DDS Security (authentication, access-control, and cryptographic plugins) reduces exposure by rejecting unauthenticated participants before the vulnerable parser path is fully exercised, at the cost of certificate/keystore management and a measurable throughput overhead.