Connext Professional
Monthly
Integer overflow combined with improper access control in the core libraries of RTI Connext Professional (versions 7.4.0 before 7.7.0.1, 7.0.0 before 7.3.1.6, and the 6.1.0 6.1.x branch) allows manipulation of shared resources, giving an attacker high impact to confidentiality, integrity, and availability of the affected host. Exploitation is not remote: it requires local access to a host running the Connext core libraries plus an existing low-privileged authenticated context, and the trigger conditions are hard to control (high attack complexity), so this is realistically a post-compromise privilege/resource escalation on DDS-participant hosts rather than a remotely reachable flaw. No CISA KEV listing and no public exploit code were identified for this issue at time of analysis. This is a genuine but access-gated issue, not a drop-everything remote emergency.
Format-string injection in RTI Connext Professional Core Libraries (versions 7.5.0 before 7.7.0.1 and 7.3.0.10 before 7.3.1.6) allows unauthenticated remote attackers with access to a DDS domain to corrupt memory, potentially leading to code execution or denial of service. Exploitation is gated by high attack complexity-the attacker must precisely control data that reaches a vulnerable format-string sink-and by the need for network reachability to a DDS domain, which is typically segmented in robotics, industrial, and defense deployments. No public exploit code has been identified at time of analysis.
Remote, unauthenticated attackers who can reach the DDS/RTPS data bus of an application built on RTI Connext Professional Core Libraries can trigger abnormal middleware behavior and degrade or halt that application's availability; the root cause is an incorrect calculation (CWE-682) that can be exploited by sending crafted DDS/RTPS traffic with no authentication, user interaction, or non-default configuration. All shipping branches are covered by the advisory: 7.4.0 through 7.7.0.0, 7.0.0 through 7.3.1.5, the 6.1.x, 6.0.x, 5.3.x and 5.2.x lines, and 4.1x through 5.0.x, with fixes available at 7.7.0.1, 7.3.1.6, and the 5.1.x legacy line. The impact is availability-only per our assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor's own CVSS 4.0 score of 8.7 reflects the same unauthenticated, network-reachable, high-availability-impact profile.
Heap-based memory corruption in RTI Connext Professional Core Libraries (7.4.0 before 7.7.0.1, 7.0.0 before 7.3.1.6, and the 6.1, 6.0, 5.3, and 5.2.3 branches) lets unauthenticated remote attackers who can reach a DDS domain corrupt heap memory by sending crafted RTPS/DDS traffic, yielding high integrity and availability impact with no confidentiality exposure. No public exploit has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), though the CVSS 4.0 AT:P metric indicates exploitation depends on a specific attack precondition such as a particular message state or sequence. Risk is concentrated in environments where DDS traffic is reachable from untrusted network positions rather than in isolated OT, robotics, or simulation segments.
A use-after-free in the Security Plugins component of RTI Connext Professional 7.6.0 through 7.7.0.0 lets an admitted, low-privilege participant in a DDS domain corrupt memory and manipulate files, producing high impact to confidentiality, integrity and availability. Exploitation is network-reachable but gated by two prerequisites: the deployment must have Security Plugins enabled (not just the base DDS libraries), and the attacker must already hold authenticated low-privilege access as an accepted DDS participant (CVSS 3.1 PR:L, CVSS 4.0 AT:P indicates an additional timing/precondition gate), so it is not exploitable against a default unauthenticated posture. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor-supplied CVSS 4.0 base score is 7.7 (High).
A stack-based buffer overflow in the RTI Connext Professional Core Libraries lets a remote, unauthenticated attacker corrupt memory by sending a crafted message to a reachable Connext/DDS endpoint, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) rates the result as high impact across confidentiality, integrity, and availability with scope change. Affected builds are Connext Professional 7.4.0 before 7.7.0.1, 7.0.0 before 7.3.1.6, and the legacy 6.1.0, 6.0.0, 5.3.0, 5.2.0, and 4.3x branches before their respective fixed releases; systems already on 7.7.0.1 or 7.3.1.6 (or later fixed builds) are not exploitable. The CVE carries a CVSS 4.0 base score of 10.0, and there is no public exploit identified at time of analysis, although the real-world exposure is bounded by the fact that DDS deployments are commonly placed on segmented or isolated real-time data-bus networks rather than the public internet.
Remote denial of service and partial data exposure in RTI Connext Professional's Web Integration Service results from a classic buffer overflow (CWE-120) reachable over the network without authentication. Versions 7.4.0 before 7.x, 7.0.0 before 7.3.1.3, and 6.1.2 before 6.1.x are vulnerable, and no public exploit identified at time of analysis. The CVSS 4.0 score of 8.8 reflects high availability impact with low confidentiality and integrity impact, consistent with a filter-failure overflow that crashes the service rather than yielding full code execution.
Out-of-bounds read in RTI Connext Professional Core Libraries allows remote unauthenticated attackers to read beyond intended buffer bounds, with the CVSS 4.0 vector (9.2 Critical) indicating high availability impact on both the vulnerable component and downstream systems consuming its data. The flaw affects a wide range of Connext Professional releases used as DDS middleware in defense, autonomous, and industrial deployments. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Remote heap-based buffer overflow in RTI Connext Professional Core Libraries allows unauthenticated network attackers to corrupt heap memory in the DDS middleware, impacting integrity and availability of both the vulnerable component and downstream subsystems. The flaw spans a wide range of long-supported branches (5.0.x through 7.6.x) and carries a CVSS 4.0 score of 9.2, though no public exploit identified at time of analysis.
XML External Entity (XXE) injection in RTI Connext Professional routing and service components allows remote unauthenticated attackers to exfiltrate sensitive data and trigger denial of service conditions. Affects multiple product families (Routing Service, Observability Collector, Recording Service, Queueing Service, Cloud Discovery Service) across versions 5.3.0 through 7.6.x. CVSS 8.8 (High) with network vector and no authentication required. EPSS probability remains low (0.04%, 11th percentile) with no confirmed active exploitation per CISA. Vendor patch available via RTI advisory.
Out-of-bounds read in the Core Libraries of RTI Connext Professional allows a locally positioned attacker with low-level privileges on a host running the middleware to trigger an overread that can crash or destabilize the affected process, producing a denial-of-service condition. Affected builds span 7.4.0 before 7.7.0.1, 7.0.0 before 7.3.1.6, and the 6.1.x, 6.0.x, 5.3.x, 5.2.x and 5.0.0-5.1.x branches; systems already on the fixed builds are not exposed. The impact is availability-only with no confidentiality or integrity effect, and because the attack requires local access and valid credentials rather than network reachability, realistic exposure is limited to insider or already-foothold scenarios causing service disruption. No public exploit code and no confirmed active exploitation were identified at time of analysis.
An off-by-one error in the RTI Connext Professional Core Libraries (CWE-193) produces an out-of-bounds write that can overflow a buffer when a crafted DDS/RTPS message is parsed, affecting Connext Professional 7.4.0 up to (but not including) 7.7.0.1 and 7.0.0 up to (but not including) 7.3.1.6. Per the CVSS 4.0 vector the flaw is remotely reachable over the network with low complexity and requires no authentication and no user interaction, but impact is bounded: there is no confidentiality loss (VC:N) and only partial integrity and availability impact (VI:L/VA:L), giving a medium-severity 6.9 rather than a code-execution-class outcome. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; practical exposure is further limited because DDS middleware is normally deployed on segmented operational networks in robotics, autonomous systems, and aerospace/defense environments rather than being directly internet-facing.
Out-of-bounds reads in the Core Libraries of RTI Connext Professional can be triggered by local attackers who already hold low-privilege access to a host running the RTI Connext data bus, causing the middleware process to crash and disrupting availability. The flaw affects Connext Professional versions 7.4.0 through 7.7.0.0, 7.3.0 through 7.3.1.5, and 6.1.2.21 onward within the 6.1.* line, and stems from a combination of type confusion, a function called with an incorrect number of arguments, and resulting buffer over-reads in the Core Libraries. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), and because exploitation requires local access plus valid low-privilege credentials while the sole impact is a process crash, the realistic priority is low-to-medium rather than matching the raw 6.8 CVSS 4.0 base score.
An out-of-bounds read combined with type confusion in the Core Libraries of RTI Connext Professional (versions 7.4.0 before 7.7.0.1, and 7.3.0 before 7.3.1.6) lets a local attacker with low privileges feed a crafted malformed data type or message that the library misinterprets, producing buffer overreads and a high-availability impact such as a crash of the affected process. The vendor's CVSS 4.0 vector (6.8, MEDIUM: AV:L/AC:L/AT:N/PR:L/UI:N, VC:N/VI:N/VA:H) describes a strictly availability-impacting flaw with no confidentiality or integrity compromise claimed, and the independently assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) agrees. Exploitation requires local access to the host running the Core Libraries rather than remote reach into a DDS domain, and at time of analysis no public exploit code or confirmed active exploitation was identified.
Double free in the Core Libraries of RTI Connext Professional 7.4.0 to 7.7.0.0 and 7.1.0 to 7.3.1.5 allows a local authenticated attacker to manipulate files and cause denial of service. The issue requires local access and low-level privileges, is not remotely reachable, and no public exploit code has been identified. Patches are available in versions 7.7.0.1 and 7.3.1.6.
Out-of-bounds write conditions in RTI Connext Professional affect three distinct components - Queueing Service, Core Libraries, and Persistence Service - enabling a locally authenticated low-privileged user to corrupt memory and produce limited integrity and availability impacts on the vulnerable system. The vulnerability spans multiple release branches (6.1.x, 7.0.x-7.3.x, and 7.4.x-7.6.x) and is resolved in versions 7.7.0 and 7.3.1.3 per vendor guidance. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Identity spoofing via missing authentication in RTI Connext Professional's Security Plugins component enables a low-privileged network attacker to impersonate legitimate DDS participants, achieving high integrity and availability impact against affected deployments. Versions spanning five major release lines - 5.3.x through 7.6.x - are affected, with the fix landing at 7.7.0 for the 7.4 branch. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high integrity and availability impacts on a middleware widely used in defense, aerospace, and industrial control systems elevate practical risk above what the moderate CVSS score alone suggests.
RTI Connext Professional's Security Plugins component allows authenticated network participants to spoof the source identity of DDS (Data Distribution Service) messages due to missing authentication on a critical data-origin verification function (CWE-306). The flaw affects versions spanning 5.3.x through 7.6.x, with a patched release available at 7.7.0 and 7.3.1.3 for the respective branches. An attacker with low-privilege access to the DDS network can falsify the apparent publisher identity of data streams, directly undermining data integrity in safety-critical deployments such as autonomous systems, industrial control, and defense applications where Connext is widely used. No public exploit code has been identified at time of analysis, and it is not listed in the CISA KEV catalog.
XML External Entity (XXE) injection in RTI Connext Professional's Core Libraries allows remote unauthenticated attackers to exfiltrate sensitive data and cause denial of service through maliciously crafted XML documents processed by the DDS middleware. Affects versions 4.3x through 7.6.x across all major release branches (4.3x-7.4.0), with vendor patch available but no public exploit identified at time of analysis. CVSS 8.8 (High) reflects network attack vector with high confidentiality and availability impact but no integrity compromise, consistent with typical XXE data exfiltration and resource exhaustion scenarios. SSVC assessment indicates non-automatable exploitation with partial technical impact, suggesting targeted attack scenarios rather than mass exploitation.
Buffer over-read vulnerability in RTI Connext Professional Core Libraries allows unauthenticated remote attackers to read beyond allocated buffer boundaries, potentially leaking sensitive data. Affected versions span multiple major release lines: 7.4.0-7.6.x, 7.0.0-7.3.0.x, 6.1.0-6.1.x, 6.0.0-6.0.x, 5.3.0-5.3.x, and 4.3x-5.2.x. The CVSS 6.3 score reflects low confidentiality impact with network-based attack surface; no public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Network traffic sniffing in RTI Connext Professional 7.2.0-7.3.0 and 7.4.0-7.6.x exposes private personal information to unauthorized remote actors with low attack complexity. The vulnerability allows confidentiality breach (high impact) with limited integrity and availability impacts, affecting distributed data-sharing middleware used in critical infrastructure and industrial systems. EPSS exploitation probability is minimal (0.05%, 15th percentile) with no confirmed active exploitation or public exploit code identified at time of analysis.
Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation.5.0 before 7.6.0. Rated medium severity (CVSS 5.8), this vulnerability is low attack complexity. No vendor patch available.
Untrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation.4.0 before 7.6.0, from 7.0.0 before 7.3.0.10, from 6.1.0 before 6.1.2.27, from. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Buffer Over-read, Off-by-one Error vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation, Overread Buffers.4.0 before 7.6.0, from 7.0.0 before 7.3.0.8, from 6.1.0 before. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. No vendor patch available.
Untrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation.4.0 before 7.6.0, from 7.2.0 before 7.3.0.9. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds Read, Out-of-bounds Write vulnerability in RTI Connext Professional (Recording Service) allows Overflow Buffers, Overread Buffers.4.0 before 7.5.0, from 7.0.0 before 7.3.0.7, from 6.1.0. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Stack-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.4.0. Rated medium severity (CVSS 6.9), this vulnerability is low attack complexity. No vendor patch available.
Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.4.0 before 7.5.0, from 7.0.0 before 7.3.0.7, from 6.1.0 before 6.1.2.23, from. Rated medium severity (CVSS 6.9), this vulnerability is low attack complexity. No vendor patch available.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routing Service) allows Overflow Variables and Tags.4.0 before 7.5.0, from 7.0.0. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional on non-Windows (Persistence Service) allows Buffer Overflow via Environment. Rated medium severity (CVSS 6.9), this vulnerability is low attack complexity. No vendor patch available.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.0.0 before 7.3.0.2, from 6.1.0. Rated medium severity (CVSS 6.9), this vulnerability is low attack complexity. No vendor patch available.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries, Routing Service) allows Overflow Variables and Tags.0.0 before. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.0.0 before 7.3.0.5, from 6.1.0. Rated medium severity (CVSS 6.9), this vulnerability is low attack complexity. No vendor patch available.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries, Queuing Service, Recording Service, Routing Service) allows Overflow. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routing Service, Recording Service, Queuing Service, Observability Collector Service,. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Heap-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in RTI Connext Professional (Security Plugins) allows. Rated medium severity (CVSS 6.9), this vulnerability is low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in RTI Connext Professional (System Designer) allows OS Command Injection.0.0 before 7.3.0.2,. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RTI Connext Professional (Queuing Service) allows SQL Injection.0.0 before 7.3.0, from 6.1.0. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In RTI Connext Professional 5.3.1 through 6.1.0 before 6.1.1, a buffer overflow in XML parsing from Routing Service, Recording Service, Queuing Service, and Cloud Discovery Service allows attackers. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
Integer overflow combined with improper access control in the core libraries of RTI Connext Professional (versions 7.4.0 before 7.7.0.1, 7.0.0 before 7.3.1.6, and the 6.1.0 6.1.x branch) allows manipulation of shared resources, giving an attacker high impact to confidentiality, integrity, and availability of the affected host. Exploitation is not remote: it requires local access to a host running the Connext core libraries plus an existing low-privileged authenticated context, and the trigger conditions are hard to control (high attack complexity), so this is realistically a post-compromise privilege/resource escalation on DDS-participant hosts rather than a remotely reachable flaw. No CISA KEV listing and no public exploit code were identified for this issue at time of analysis. This is a genuine but access-gated issue, not a drop-everything remote emergency.
Format-string injection in RTI Connext Professional Core Libraries (versions 7.5.0 before 7.7.0.1 and 7.3.0.10 before 7.3.1.6) allows unauthenticated remote attackers with access to a DDS domain to corrupt memory, potentially leading to code execution or denial of service. Exploitation is gated by high attack complexity-the attacker must precisely control data that reaches a vulnerable format-string sink-and by the need for network reachability to a DDS domain, which is typically segmented in robotics, industrial, and defense deployments. No public exploit code has been identified at time of analysis.
Remote, unauthenticated attackers who can reach the DDS/RTPS data bus of an application built on RTI Connext Professional Core Libraries can trigger abnormal middleware behavior and degrade or halt that application's availability; the root cause is an incorrect calculation (CWE-682) that can be exploited by sending crafted DDS/RTPS traffic with no authentication, user interaction, or non-default configuration. All shipping branches are covered by the advisory: 7.4.0 through 7.7.0.0, 7.0.0 through 7.3.1.5, the 6.1.x, 6.0.x, 5.3.x and 5.2.x lines, and 4.1x through 5.0.x, with fixes available at 7.7.0.1, 7.3.1.6, and the 5.1.x legacy line. The impact is availability-only per our assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor's own CVSS 4.0 score of 8.7 reflects the same unauthenticated, network-reachable, high-availability-impact profile.
Heap-based memory corruption in RTI Connext Professional Core Libraries (7.4.0 before 7.7.0.1, 7.0.0 before 7.3.1.6, and the 6.1, 6.0, 5.3, and 5.2.3 branches) lets unauthenticated remote attackers who can reach a DDS domain corrupt heap memory by sending crafted RTPS/DDS traffic, yielding high integrity and availability impact with no confidentiality exposure. No public exploit has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), though the CVSS 4.0 AT:P metric indicates exploitation depends on a specific attack precondition such as a particular message state or sequence. Risk is concentrated in environments where DDS traffic is reachable from untrusted network positions rather than in isolated OT, robotics, or simulation segments.
A use-after-free in the Security Plugins component of RTI Connext Professional 7.6.0 through 7.7.0.0 lets an admitted, low-privilege participant in a DDS domain corrupt memory and manipulate files, producing high impact to confidentiality, integrity and availability. Exploitation is network-reachable but gated by two prerequisites: the deployment must have Security Plugins enabled (not just the base DDS libraries), and the attacker must already hold authenticated low-privilege access as an accepted DDS participant (CVSS 3.1 PR:L, CVSS 4.0 AT:P indicates an additional timing/precondition gate), so it is not exploitable against a default unauthenticated posture. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor-supplied CVSS 4.0 base score is 7.7 (High).
A stack-based buffer overflow in the RTI Connext Professional Core Libraries lets a remote, unauthenticated attacker corrupt memory by sending a crafted message to a reachable Connext/DDS endpoint, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) rates the result as high impact across confidentiality, integrity, and availability with scope change. Affected builds are Connext Professional 7.4.0 before 7.7.0.1, 7.0.0 before 7.3.1.6, and the legacy 6.1.0, 6.0.0, 5.3.0, 5.2.0, and 4.3x branches before their respective fixed releases; systems already on 7.7.0.1 or 7.3.1.6 (or later fixed builds) are not exploitable. The CVE carries a CVSS 4.0 base score of 10.0, and there is no public exploit identified at time of analysis, although the real-world exposure is bounded by the fact that DDS deployments are commonly placed on segmented or isolated real-time data-bus networks rather than the public internet.
Remote denial of service and partial data exposure in RTI Connext Professional's Web Integration Service results from a classic buffer overflow (CWE-120) reachable over the network without authentication. Versions 7.4.0 before 7.x, 7.0.0 before 7.3.1.3, and 6.1.2 before 6.1.x are vulnerable, and no public exploit identified at time of analysis. The CVSS 4.0 score of 8.8 reflects high availability impact with low confidentiality and integrity impact, consistent with a filter-failure overflow that crashes the service rather than yielding full code execution.
Out-of-bounds read in RTI Connext Professional Core Libraries allows remote unauthenticated attackers to read beyond intended buffer bounds, with the CVSS 4.0 vector (9.2 Critical) indicating high availability impact on both the vulnerable component and downstream systems consuming its data. The flaw affects a wide range of Connext Professional releases used as DDS middleware in defense, autonomous, and industrial deployments. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Remote heap-based buffer overflow in RTI Connext Professional Core Libraries allows unauthenticated network attackers to corrupt heap memory in the DDS middleware, impacting integrity and availability of both the vulnerable component and downstream subsystems. The flaw spans a wide range of long-supported branches (5.0.x through 7.6.x) and carries a CVSS 4.0 score of 9.2, though no public exploit identified at time of analysis.
XML External Entity (XXE) injection in RTI Connext Professional routing and service components allows remote unauthenticated attackers to exfiltrate sensitive data and trigger denial of service conditions. Affects multiple product families (Routing Service, Observability Collector, Recording Service, Queueing Service, Cloud Discovery Service) across versions 5.3.0 through 7.6.x. CVSS 8.8 (High) with network vector and no authentication required. EPSS probability remains low (0.04%, 11th percentile) with no confirmed active exploitation per CISA. Vendor patch available via RTI advisory.
Out-of-bounds read in the Core Libraries of RTI Connext Professional allows a locally positioned attacker with low-level privileges on a host running the middleware to trigger an overread that can crash or destabilize the affected process, producing a denial-of-service condition. Affected builds span 7.4.0 before 7.7.0.1, 7.0.0 before 7.3.1.6, and the 6.1.x, 6.0.x, 5.3.x, 5.2.x and 5.0.0-5.1.x branches; systems already on the fixed builds are not exposed. The impact is availability-only with no confidentiality or integrity effect, and because the attack requires local access and valid credentials rather than network reachability, realistic exposure is limited to insider or already-foothold scenarios causing service disruption. No public exploit code and no confirmed active exploitation were identified at time of analysis.
An off-by-one error in the RTI Connext Professional Core Libraries (CWE-193) produces an out-of-bounds write that can overflow a buffer when a crafted DDS/RTPS message is parsed, affecting Connext Professional 7.4.0 up to (but not including) 7.7.0.1 and 7.0.0 up to (but not including) 7.3.1.6. Per the CVSS 4.0 vector the flaw is remotely reachable over the network with low complexity and requires no authentication and no user interaction, but impact is bounded: there is no confidentiality loss (VC:N) and only partial integrity and availability impact (VI:L/VA:L), giving a medium-severity 6.9 rather than a code-execution-class outcome. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; practical exposure is further limited because DDS middleware is normally deployed on segmented operational networks in robotics, autonomous systems, and aerospace/defense environments rather than being directly internet-facing.
Out-of-bounds reads in the Core Libraries of RTI Connext Professional can be triggered by local attackers who already hold low-privilege access to a host running the RTI Connext data bus, causing the middleware process to crash and disrupting availability. The flaw affects Connext Professional versions 7.4.0 through 7.7.0.0, 7.3.0 through 7.3.1.5, and 6.1.2.21 onward within the 6.1.* line, and stems from a combination of type confusion, a function called with an incorrect number of arguments, and resulting buffer over-reads in the Core Libraries. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), and because exploitation requires local access plus valid low-privilege credentials while the sole impact is a process crash, the realistic priority is low-to-medium rather than matching the raw 6.8 CVSS 4.0 base score.
An out-of-bounds read combined with type confusion in the Core Libraries of RTI Connext Professional (versions 7.4.0 before 7.7.0.1, and 7.3.0 before 7.3.1.6) lets a local attacker with low privileges feed a crafted malformed data type or message that the library misinterprets, producing buffer overreads and a high-availability impact such as a crash of the affected process. The vendor's CVSS 4.0 vector (6.8, MEDIUM: AV:L/AC:L/AT:N/PR:L/UI:N, VC:N/VI:N/VA:H) describes a strictly availability-impacting flaw with no confidentiality or integrity compromise claimed, and the independently assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) agrees. Exploitation requires local access to the host running the Core Libraries rather than remote reach into a DDS domain, and at time of analysis no public exploit code or confirmed active exploitation was identified.
Double free in the Core Libraries of RTI Connext Professional 7.4.0 to 7.7.0.0 and 7.1.0 to 7.3.1.5 allows a local authenticated attacker to manipulate files and cause denial of service. The issue requires local access and low-level privileges, is not remotely reachable, and no public exploit code has been identified. Patches are available in versions 7.7.0.1 and 7.3.1.6.
Out-of-bounds write conditions in RTI Connext Professional affect three distinct components - Queueing Service, Core Libraries, and Persistence Service - enabling a locally authenticated low-privileged user to corrupt memory and produce limited integrity and availability impacts on the vulnerable system. The vulnerability spans multiple release branches (6.1.x, 7.0.x-7.3.x, and 7.4.x-7.6.x) and is resolved in versions 7.7.0 and 7.3.1.3 per vendor guidance. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Identity spoofing via missing authentication in RTI Connext Professional's Security Plugins component enables a low-privileged network attacker to impersonate legitimate DDS participants, achieving high integrity and availability impact against affected deployments. Versions spanning five major release lines - 5.3.x through 7.6.x - are affected, with the fix landing at 7.7.0 for the 7.4 branch. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high integrity and availability impacts on a middleware widely used in defense, aerospace, and industrial control systems elevate practical risk above what the moderate CVSS score alone suggests.
RTI Connext Professional's Security Plugins component allows authenticated network participants to spoof the source identity of DDS (Data Distribution Service) messages due to missing authentication on a critical data-origin verification function (CWE-306). The flaw affects versions spanning 5.3.x through 7.6.x, with a patched release available at 7.7.0 and 7.3.1.3 for the respective branches. An attacker with low-privilege access to the DDS network can falsify the apparent publisher identity of data streams, directly undermining data integrity in safety-critical deployments such as autonomous systems, industrial control, and defense applications where Connext is widely used. No public exploit code has been identified at time of analysis, and it is not listed in the CISA KEV catalog.
XML External Entity (XXE) injection in RTI Connext Professional's Core Libraries allows remote unauthenticated attackers to exfiltrate sensitive data and cause denial of service through maliciously crafted XML documents processed by the DDS middleware. Affects versions 4.3x through 7.6.x across all major release branches (4.3x-7.4.0), with vendor patch available but no public exploit identified at time of analysis. CVSS 8.8 (High) reflects network attack vector with high confidentiality and availability impact but no integrity compromise, consistent with typical XXE data exfiltration and resource exhaustion scenarios. SSVC assessment indicates non-automatable exploitation with partial technical impact, suggesting targeted attack scenarios rather than mass exploitation.
Buffer over-read vulnerability in RTI Connext Professional Core Libraries allows unauthenticated remote attackers to read beyond allocated buffer boundaries, potentially leaking sensitive data. Affected versions span multiple major release lines: 7.4.0-7.6.x, 7.0.0-7.3.0.x, 6.1.0-6.1.x, 6.0.0-6.0.x, 5.3.0-5.3.x, and 4.3x-5.2.x. The CVSS 6.3 score reflects low confidentiality impact with network-based attack surface; no public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Network traffic sniffing in RTI Connext Professional 7.2.0-7.3.0 and 7.4.0-7.6.x exposes private personal information to unauthorized remote actors with low attack complexity. The vulnerability allows confidentiality breach (high impact) with limited integrity and availability impacts, affecting distributed data-sharing middleware used in critical infrastructure and industrial systems. EPSS exploitation probability is minimal (0.05%, 15th percentile) with no confirmed active exploitation or public exploit code identified at time of analysis.
Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation.5.0 before 7.6.0. Rated medium severity (CVSS 5.8), this vulnerability is low attack complexity. No vendor patch available.
Untrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation.4.0 before 7.6.0, from 7.0.0 before 7.3.0.10, from 6.1.0 before 6.1.2.27, from. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Buffer Over-read, Off-by-one Error vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation, Overread Buffers.4.0 before 7.6.0, from 7.0.0 before 7.3.0.8, from 6.1.0 before. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. No vendor patch available.
Untrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation.4.0 before 7.6.0, from 7.2.0 before 7.3.0.9. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds Read, Out-of-bounds Write vulnerability in RTI Connext Professional (Recording Service) allows Overflow Buffers, Overread Buffers.4.0 before 7.5.0, from 7.0.0 before 7.3.0.7, from 6.1.0. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Stack-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.4.0. Rated medium severity (CVSS 6.9), this vulnerability is low attack complexity. No vendor patch available.
Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.4.0 before 7.5.0, from 7.0.0 before 7.3.0.7, from 6.1.0 before 6.1.2.23, from. Rated medium severity (CVSS 6.9), this vulnerability is low attack complexity. No vendor patch available.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routing Service) allows Overflow Variables and Tags.4.0 before 7.5.0, from 7.0.0. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional on non-Windows (Persistence Service) allows Buffer Overflow via Environment. Rated medium severity (CVSS 6.9), this vulnerability is low attack complexity. No vendor patch available.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.0.0 before 7.3.0.2, from 6.1.0. Rated medium severity (CVSS 6.9), this vulnerability is low attack complexity. No vendor patch available.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries, Routing Service) allows Overflow Variables and Tags.0.0 before. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.0.0 before 7.3.0.5, from 6.1.0. Rated medium severity (CVSS 6.9), this vulnerability is low attack complexity. No vendor patch available.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries, Queuing Service, Recording Service, Routing Service) allows Overflow. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routing Service, Recording Service, Queuing Service, Observability Collector Service,. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Heap-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in RTI Connext Professional (Security Plugins) allows. Rated medium severity (CVSS 6.9), this vulnerability is low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in RTI Connext Professional (System Designer) allows OS Command Injection.0.0 before 7.3.0.2,. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RTI Connext Professional (Queuing Service) allows SQL Injection.0.0 before 7.3.0, from 6.1.0. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In RTI Connext Professional 5.3.1 through 6.1.0 before 6.1.1, a buffer overflow in XML parsing from Routing Service, Recording Service, Queuing Service, and Cloud Discovery Service allows attackers. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.