RTI Connext Professional
CVE-2026-2674
MEDIUM
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access and low privileges required per vendor CVSS 4.0 vector; no confidentiality impact and scope unchanged with limited integrity and availability effects.
Primary rating from Vendor (RTI).
CVSS VectorVendor: RTI
Lifecycle Timeline
1DescriptionCVE.org
Out-of-bounds Write, Out-of-bounds Write, Out-of-bounds Write vulnerability in RTI Connext Professional (Queueing Service,Core Libraries,Persistence Service) allows Overflow Buffers, Overflow Buffers, Overflow Buffers.This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.3, from 6.1.0 before 6.1.*.
AnalysisAI
Out-of-bounds write conditions in RTI Connext Professional affect three distinct components - Queueing Service, Core Libraries, and Persistence Service - enabling a locally authenticated low-privileged user to corrupt memory and produce limited integrity and availability impacts on the vulnerable system. The vulnerability spans multiple release branches (6.1.x, 7.0.x-7.3.x, and 7.4.x-7.6.x) and is resolved in versions 7.7.0 and 7.3.1.3 per vendor guidance. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Technical ContextAI
RTI Connext Professional is a commercial Data Distribution Service (DDS) middleware platform widely deployed in real-time distributed systems including autonomous vehicles, industrial control systems, and defense applications. The affected CPE (cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*) covers multiple version branches. CWE-787 (Out-of-bounds Write) identifies the root cause class: one or more of the three affected subsystems writes data past the boundary of an allocated memory buffer, potentially overwriting adjacent memory regions. The CVSS 4.0 vector's local attack vector (AV:L) confirms exploitation occurs through local interaction with the DDS middleware processes rather than across a network, consistent with how these services typically receive data from co-located publishers and subscribers on the same host. The breadth of affected components - Core Libraries in particular - suggests the underlying defect may manifest across multiple code paths in the middleware stack.
RemediationAI
The primary fix is to upgrade RTI Connext Professional to version 7.7.0 for users on the 7.4.x branch, or to version 7.3.1.3 for users on the 7.0.x-7.3.x branch; 6.1.x users should consult the vendor advisory at https://www.rti.com/vulnerabilities/#cve-2026-2674 for the appropriate 6.1.x maintenance release. Where immediate patching is not feasible, restrict local OS access to the minimum necessary users and processes on hosts running Connext Professional - since AV:L requires local presence, hardening host-level access is the most direct compensating control. If Queueing Service or Persistence Service are not operationally required, disabling those specific components reduces the exploitable surface with the trade-off of losing those middleware capabilities. Network segmentation of DDS hosts limits the blast radius should an attacker gain local access through a separate vector.
More in Connext Professional
View allRemote heap-based buffer overflow in RTI Connext Professional Core Libraries allows unauthenticated network attackers to
Out-of-bounds read in RTI Connext Professional Core Libraries allows remote unauthenticated attackers to read beyond int
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RTI Connext Profes
Remote denial of service and partial data exposure in RTI Connext Professional's Web Integration Service results from a
XML External Entity (XXE) injection in RTI Connext Professional's Core Libraries allows remote unauthenticated attackers
XML External Entity (XXE) injection in RTI Connext Professional routing and service components allows remote unauthentic
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in RTI Connext
Untrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation.4.0
Network traffic sniffing in RTI Connext Professional 7.2.0-7.3.0 and 7.4.0-7.6.x exposes private personal information to
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routin
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core L
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core L
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today