EUVD-2026-84613
GHSA-25jc-v56j-jxq8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privilege access to Connext host
-
DeliveryCraft malformed/type-confused input to Core Libraries
-
ExploitTrigger out-of-bounds read (type confusion / wrong arg count)
-
ExecutionCrash Connext process
-
ImpactDenial of service to DDS application
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires LOCAL access to a host running RTI Connext Professional Core Libraries (AV:L) AND valid low-privilege authentication/authorization (PR:L) to deliver the crafted input that triggers the type-confusion / incorrect-argument-count out-of-bounds read; no user interaction is needed (UI:N). Impact is limited to availability (process crash / DoS) - no confidentiality or integrity effect per the vendor. Affected only in versions 7.4.0-7.7.0.0, 7.3.0-7.3.1.5, and 6.1.2.21 up to the 6.1.* fix; remote network exploitation is NOT possible, which substantially limits realistic risk to insiders or already-compromised local accounts. |
| Impact | This is a LOW-to-MEDIUM real-world priority despite the 6.8 CVSS 4.0 score. The vendor vector (AV:L/AC:L/PR:L/UI:N/VC:N/VI:N/VA:H) is the key signal: exploitation requires LOCAL access (AV:L) and existing low-privilege authentication (PR:L), and the ONLY impact is availability (VA:H) - confidentiality and integrity are explicitly N. This sharply contradicts the 'Information Disclosure' tag: despite the CWE-125 out-of-bounds READ, the vendor confirms VC:N, meaning no data is actually exposed; the over-read manifests as a crash/DoS, not a leak. No EPSS score, no CISA KEV listing, and no public POC are present in the data, so there is no evidence of active or automatable exploitation. Contrast this with network-reachable siblings in the same RTI batch (e.g. CVE-2026-7866 stack-overflow RCE at 10.0): the local-only vector and availability-only impact make this the lowest-risk member of the group. Single-source, self-reported by RTI with no independent corroboration - treat exploitation status as unproven. |
| Exploit ScenarioDerived | A local user with legitimate low-privilege access to a host running RTI Connext Professional supplies crafted input (malformed message/data whose type or argument count mismatches expectations) that triggers a type-confusion / wrong-argument-count out-of-bounds read in the Core Libraries. The over-read corrupts execution and crashes the Connext process or dependent application, disrupting the DDS-based real-time system. No public exploit code is identified at time of analysis, and the local-access + authentication requirements limit this to insiders or already-compromised accounts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Out-of-bounds reads in the Core Libraries of RTI Connext Professional can be triggered by local attackers who already hold low-privilege access to a host running the RTI Connext data bus, causing the middleware process to crash and disrupting availability. The flaw affects Connext Professional versions 7.4.0 through 7.7.0.0, 7.3.0 through 7.3.1.5, and 6.1.2.21 onward within the 6.1.* line, and stems from a combination of type confusion, a function called with an incorrect number of arguments, and resulting buffer over-reads in the Core Libraries. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), and because exploitation requires local access plus valid low-privilege credentials while the sole impact is a process crash, the realistic priority is low-to-medium rather than matching the raw 6.8 CVSS 4.0 base score.
RemediationAI
Vendor-released patch: upgrade to Connext Professional 7.7.0.1, 7.3.1.6, or the fixed 6.1.* build identified in the RTI advisory at https://www.rti.com/vulnerabilities/#cve-2026-18458, selecting the branch that matches your deployment; no vendor-released patch has been identified for versions older than the 6.1.2.21 baseline, so those systems must be moved onto a supported branch to be remediated. Where an immediate upgrade is not possible, reduce exposure by treating the Core Libraries host as a trusted boundary: restrict local login and interactive shell access to the minimum set of accounts and services (this directly removes the PR:L prerequisite, but does not help against already-compromised accounts or malicious local users), run DDS participants as an unprivileged, sandboxed service account under a container or OS confinement profile such as SELinux/AppArmor so a crash cannot escalate, and disable or avoid loading unused type plug-ins and dynamic type handling where the application does not require them (this narrows the type-confusion attack surface but will break deployments that rely on dynamic types). Because the impact is availability-only, add process supervision and crash-loop alerting so that repeated Connext restarts are detected as a possible exploitation attempt rather than dismissed as instability, and monitor for unauthorized local sessions on DDS hosts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RTI Connext Professional is a commercial DDS (Data Distribution Service) middleware used in real-time and embedded systems, and the affected component is its Core Libraries - the serialization, type-handling and participant/endpoint machinery that processes topic data and type information. The vulnerability is rooted in CWE-125 (Out-of-bounds Read), and the vendor description attributes the over-read to two compounding defects: a function invoked with an incorrect number of arguments and a type confusion where a resource is accessed using an incompatible type. In practical terms, malformed type or data input can cause the library to interpret a buffer according to the wrong type layout, mis-compute a length or argument list, and then read past the end of the allocated buffer. The CPE identifiers map to the generic rti:connext_professional product family, confirming the Core Libraries are library-level, not application-specific, which is why multiple 7.x, 7.3.x and 6.1.x branches are in scope simultaneously. The vendor self-reported the issue and classifies the outcome as an over-read with availability-only consequences (VC:N/VI:N/VA:H in the assessed CVSS 3.1 base of AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning an attacker cannot read out useful data or modify anything but can terminate the process.
Know when Connext Professional gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Local vector and low-privilege authentication are taken directly from the vendor 4.0 vector (AV:L/PR:L); over-read produces only a crash, so C:N/I:N/A:H with unchanged scope.
Primary rating from Vendor (RTI).
CVSS VectorVendor: RTI
Lifecycle Timeline
1DescriptionCVE.org
Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.3.0 before 7.3.1.6, from 6.1.2.21 before 6.1.*.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Connext Professional
View allA stack-based buffer overflow in the RTI Connext Professional Core Libraries lets a remote, unauthenticated attacker cor
Remote heap-based buffer overflow in RTI Connext Professional Core Libraries allows unauthenticated network attackers to
Out-of-bounds read in RTI Connext Professional Core Libraries allows remote unauthenticated attackers to read beyond int
Format-string injection in RTI Connext Professional Core Libraries (versions 7.5.0 before 7.7.0.1 and 7.3.0.10 before 7.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RTI Connext Profes
Remote denial of service and partial data exposure in RTI Connext Professional's Web Integration Service results from a
XML External Entity (XXE) injection in RTI Connext Professional's Core Libraries allows remote unauthenticated attackers
XML External Entity (XXE) injection in RTI Connext Professional routing and service components allows remote unauthentic
Remote, unauthenticated attackers who can reach the DDS/RTPS data bus of an application built on RTI Connext Professiona
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in RTI Connext
Untrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation.4.0
Untrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation.4.0
Exploit-DB