CVE-2026-2467: RTI Connext Professional Heap Buffer Overflow (CVSS 8.1)

Technical summary

CVE-2026-2467 is a heap-based buffer overflow (CWE-122) in RTI Connext Professional core libraries. The vulnerability stems from improper bounds checking when processing variables and tags, permitting an authenticated attacker to write beyond allocated heap memory. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) indicates network accessibility with low attack complexity; authentication is required, but no user interaction is necessary. The flaw carries a HIGH severity rating with impact primarily on integrity and availability.

Business impact

RTI Connext Professional is widely deployed in real-time data distribution systems across automotive, aerospace, defense, and industrial IoT sectors. A successful exploit could cause denial of service by crashing critical middleware, or modify data in transit, leading to application instability and potential cascading failures in time-sensitive systems. Organizations relying on Connext for mission-critical messaging face operational risk until patching is completed. The authentication requirement limits the threat surface to insider threats and compromised client certificates.

Affected systems

RTI Connext Professional versions are vulnerable across a broad range: 7.4.0 through 7.6.x, 7.0.0 through 7.3.1.2, 6.1.0 through 6.1.x, 6.0.0 through 6.0.x, 5.3.0 through 5.3.x, and 5.0.0 through 5.2.x. Organizations must check their installed version number against RTI's advisory to determine exposure. Any deployment using core libraries from these ranges requires assessment and patching.

Exploitability

Exploitation requires valid authentication credentials to connect to an RTI Connext domain. This significantly restricts attack surface compared to unauthenticated network flaws. However, within environments where credentials are shared, compromised, or where authentication is weak, the low attack complexity means an attacker with access can trigger the overflow without specialized knowledge or user interaction. The flaw is not yet listed in CISA's Known Exploited Vulnerabilities catalog, suggesting limited real-world exploitation activity at publication.

Remediation

RTI Connext Professional users must upgrade to patched versions: 7.7.0 or later for the 7.x branch, 7.3.1.3 or later for 7.0–7.3, and corresponding patched versions for 6.x and 5.x branches. Verify exact patch versions in RTI's official security advisory before deployment. Organizations unable to patch immediately should restrict network access to Connext domains and enforce strong authentication controls on client certificates.

Patch guidance

Check your RTI Connext Professional version via the DDS administration console or version command. Cross-reference against the affected ranges provided. Download patches directly from RTI's support portal using your service contract credentials. Test patches in a staging environment that mirrors production topology before production deployment. For 7.x deployments, prioritize upgrading to 7.7.0 or later; for 6.x and 5.x, follow RTI's specific guidance on available patch versions for your release branch. Document patch application and maintain audit trails.

Detection guidance

Monitor for unexpected process crashes or terminations in Connext middleware components; heap corruptions often manifest as segmentation faults or access violations. Enable Connext debug logging to capture buffer operations. Network IDS/IPS rules should flag malformed DDS messages targeting variables and tags if signatures become available. Inspect authentication logs for successful connections from unexpected clients or unusual patterns. Heap overflow attempts may appear as memory corruption errors in system logs preceding application crashes. Establish a baseline of normal Connext behavior for comparison.

Why prioritize this

Although not yet in active public exploitation, this HIGH-severity vulnerability combines authenticated network access with guaranteed denial-of-service and data integrity impact. Organizations running Connext Professional in real-time systems where availability is critical should prioritize patching. The wide version range affected means legacy deployments are at particular risk. The authentication requirement provides a window for defensive measures, but should not delay patch planning.

Risk score, explained

The CVSS 8.1 HIGH rating reflects the high impact on data integrity and availability (I:H, A:H), combined with low attack complexity and network accessibility. The requirement for prior authentication (PR:L) prevents the score from reaching CRITICAL, but the lack of confidentiality impact does not diminish the operational threat. In environments with weak credential management or insider risk, effective severity may be higher.

Frequently asked questions