EUVD-2026-84611
GHSA-v63h-ppxr-x489
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged access
-
ExploitSupply crafted malformed type/message
-
ExecutionTrigger out-of-bounds read / type confusion
-
ImpactCrash Connext process (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access with low privileges (AV:L/PR:L) to the host running RTI Connext Professional Core Libraries and the ability to feed a crafted malformed data type or message that triggers the type-confusion/out-of-bounds read. Affected only in versions 7.4.0 before 7.7.0.1 and 7.3.0 before 7.3.1.6. Limiting factors: exploitation yields availability impact only (process crash), needs local vector rather than remote DDS-domain reach as scored, and requires at least low-level privileges; no confidentiality or integrity compromise is claimed by the vendor. |
| Impact | The vendor (RTI) CVSS 4.0 vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H (base 6.8, MEDIUM) describes a strictly availability-impacting flaw: local attack vector, low complexity, low privileges required, no user interaction, and NO confidentiality or integrity impact (VC:N/VI:N) with high availability impact (VA:H). This is notable because the CWE class (CWE-125 out-of-bounds read / type confusion / 'overread buffers') would typically raise confidentiality concerns, yet RTI explicitly rated VC:N - indicating the overread manifests as a crash/denial of service rather than data leakage. There is no EPSS score, no CISA KEV listing, and no public POC referenced, so this is no public exploit identified at time of analysis. The single self-reported RTI advisory is the only source. Real-world priority is LOW-to-MEDIUM: the local vector (AV:L) plus required privileges (PR:L) and availability-only impact make this far less urgent than the network-reachable RCE siblings in the same product line. One conflict to verify: DDS middleware is normally exercised over the network, yet RTI scored this AV:L - confirm with the vendor whether the crafted malicious input must be delivered locally (e.g., via a local application/type descriptor) rather than over a DDS domain. |
| Exploit ScenarioDerived | A low-privileged local attacker or a co-located malicious/compromised application feeds a crafted, malformed data type or message into a Connext Professional Core Library routine, triggering a type-confusion-driven out-of-bounds read that reads past a buffer boundary and crashes the process. The result is denial of service against the DDS participant; no public exploit code is available and the local vector plus required privileges limit reach. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
An out-of-bounds read combined with type confusion in the Core Libraries of RTI Connext Professional (versions 7.4.0 before 7.7.0.1, and 7.3.0 before 7.3.1.6) lets a local attacker with low privileges feed a crafted malformed data type or message that the library misinterprets, producing buffer overreads and a high-availability impact such as a crash of the affected process. The vendor's CVSS 4.0 vector (6.8, MEDIUM: AV:L/AC:L/AT:N/PR:L/UI:N, VC:N/VI:N/VA:H) describes a strictly availability-impacting flaw with no confidentiality or integrity compromise claimed, and the independently assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) agrees. Exploitation requires local access to the host running the Core Libraries rather than remote reach into a DDS domain, and at time of analysis no public exploit code or confirmed active exploitation was identified.
RemediationAI
Upgrade to the fixed releases indicated by the affected version ranges: RTI Connext Professional 7.7.0.1 (for the 7.4.0-through-7.6.x line) or 7.3.1.6 (for the 7.3.0 line), and confirm the exact target build against the vendor advisory at https://www.rti.com/vulnerabilities/#cve-2026-11389, which is the authoritative source for the patch matrix and any product-specific notes. Where an immediate upgrade is not possible, compensating controls should be applied with their trade-offs understood: restrict interactive and process-level access to hosts running Connext Core Libraries so that only trusted, least-privileged accounts can submit type definitions or inject data (this reduces the PR:L attack surface but does not eliminate risk from a compromised low-privilege account); enable the DDS Security plugins (authentication, access control and cryptographic plugins) so that only authenticated and authorized participants can publish types or samples, accepting the added key-management overhead and the performance cost of encryption/signing; and validate or whitelist the type definitions and QoS/topic configurations accepted into a domain, since an unexpected or mismatched type is the trigger for the type confusion. Because the impact is availability-only, monitor Connext processes for unexpected crashes or abnormal terminations and treat repeated core dumps as a possible exploitation signal. Note that no vendor-released patch version was independently confirmed beyond the fixed boundaries implied by the affected ranges, no public exploit code was identified at time of analysis, and the vulnerability was not confirmed as actively exploited (CISA KEV).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RTI Connext Professional is a commercial implementation of the OMG Data Distribution Service (DDS) publish-subscribe middleware used in industrial, aerospace, defense, medical and automotive systems, and the affected component is its Core Libraries that handle serialization, deserialization and dispatch of typed data. The flaw is rooted in CWE-125 (Out-of-bounds Read), reported alongside a function call made with an incorrect number of arguments and an access of a resource using an incompatible type (type confusion): when a malformed or mismatched data type/instance is processed, the core library can reinterpret a buffer under the wrong type layout and then index or read past its end, producing the overread. Type confusion of this class typically arises from inadequate validation of type definitions against the actual wire/buffer representation before invoking a handler with the derived type metadata, so the intermediate code trusts sizes or offsets that the attacker-controlled input does not satisfy. The CPE entry cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:* confirms the vendor/product pairing but is fully wildcarded on version, so precise scoping must rely on the stated ranges (7.4.0 before 7.7.0.1 and 7.3.0 before 7.3.1.6).
Know when Connext Professional gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Mirrors vendor local low-privilege vector; out-of-bounds read produces a crash so A:H with C:N/I:N, no scope change.
Primary rating from Vendor (RTI).
CVSS VectorVendor: RTI
Lifecycle Timeline
1DescriptionCVE.org
Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.3.0 before 7.3.1.6.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Connext Professional
View allA stack-based buffer overflow in the RTI Connext Professional Core Libraries lets a remote, unauthenticated attacker cor
Remote heap-based buffer overflow in RTI Connext Professional Core Libraries allows unauthenticated network attackers to
Out-of-bounds read in RTI Connext Professional Core Libraries allows remote unauthenticated attackers to read beyond int
Format-string injection in RTI Connext Professional Core Libraries (versions 7.5.0 before 7.7.0.1 and 7.3.0.10 before 7.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RTI Connext Profes
Remote denial of service and partial data exposure in RTI Connext Professional's Web Integration Service results from a
XML External Entity (XXE) injection in RTI Connext Professional's Core Libraries allows remote unauthenticated attackers
XML External Entity (XXE) injection in RTI Connext Professional routing and service components allows remote unauthentic
Remote, unauthenticated attackers who can reach the DDS/RTPS data bus of an application built on RTI Connext Professiona
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in RTI Connext
Untrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation.4.0
Untrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation.4.0
Exploit-DB