CVE-2026-2674: RTI Connext Professional Out-of-Bounds Write (CVSS 8.1)

Technical summary

CVE-2026-2674 is a CWE-787 out-of-bounds write vulnerability in RTI Connext Professional's Queueing Service, Core Libraries, and Persistence Service. The flaw allows an authenticated attacker with network access to write data beyond allocated buffer boundaries by sending a malicious request. The vulnerability exists in version 7.4.0 through 7.6.x (before 7.7.0), 7.0.0 through 7.3.1.2 (before 7.3.1.3), and 6.1.0 through 6.1.x branches. With a CVSS 3.1 score of 8.1 (HIGH), the vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H indicates network exploitability, low attack complexity, requirement for low-level privileges, no user interaction, and high impact on integrity and availability.

Business impact

Organizations using Connext Professional for real-time distributed systems face significant operational risk. A successful exploit could corrupt critical data flows, disrupt DDS (Data Distribution Service) communications, or crash middleware services without warning. For systems controlling industrial processes, autonomous vehicles, or time-sensitive financial transactions, such availability or integrity loss translates directly to operational downtime, data corruption, or safety incidents. The authentication requirement raises the bar slightly, but compromised or insider access makes this a realistic threat.

Affected systems

RTI Connext Professional deployments across all supported minor versions in three release trains are affected: 7.4.0–7.6.x, 7.0.0–7.3.1.2, and 6.1.0–6.1.x. Any organization running these versions for middleware, real-time pub/sub messaging, or distributed system orchestration should assume exposure. Verify your installed version against RTI's advisory; patch availability varies by release branch.

Exploitability

Exploitation requires authenticated network access, making this more accessible than an unauthenticated remote code execution but still limited to users or services with valid credentials. An attacker must craft a specific message that triggers the out-of-bounds write in one of the three affected components. While no public exploit code or active weaponization is known, the straightforward nature of buffer overflows and the availability of Connext protocol documentation create moderate exploit risk once details are disclosed.

Remediation

Upgrade to patched versions: Connext Professional 7.7.0 or later (for 7.4.x line), 7.3.1.3 or later (for 7.0.x line), and verify the 6.1.x patch status with RTI directly. If immediate patching is not feasible, restrict network access to Connext services, enforce strong authentication, and monitor for suspicious authentication patterns or anomalous DDS traffic that could indicate exploitation attempts.

Patch guidance

RTI has released patches addressing this vulnerability. Consult the official RTI Connext security advisory for exact patch versions and availability by release branch. Organizations on 7.4.0–7.6.x should upgrade to 7.7.0 or later; those on 7.0.0–7.3.1.2 should upgrade to 7.3.1.3 or later. For 6.1.0–6.1.x users, verify patch status directly with RTI, as support timelines differ. Test patches in a non-production environment first, as Connext upgrades can affect dependent applications.

Detection guidance

Monitor Connext services for unexpected process crashes or memory corruption signatures within the Queueing Service, Core Libraries, or Persistence Service. Examine network traffic for malformed or oversized DDS packets destined for Connext ports. Collect authentication logs to identify attempted access by unauthorized or suspicious accounts. Enable Connext diagnostic logging if available to capture buffer anomalies or core dumps. Deploy IDS/IPS rules targeting known Connext protocol abuse patterns once available from RTI or security vendors.

Why prioritize this

HIGH severity (CVSS 8.1) combined with high impact to integrity and availability justifies urgent attention, even though authentication is required. The flaw affects three critical Connext components and multiple version branches, increasing the likelihood of exposure across a typical RTI customer base. Real-time and safety-critical systems relying on Connext warrant early patching; general-purpose deployments should prioritize within 60 days of patch release.

Risk score, explained

CVSS 3.1 score of 8.1 reflects a HIGH-severity impact: network-accessible flaw (AV:N) with low attack complexity (AC:L) that can be triggered by a low-privileged authenticated user (PR:L). While confidentiality is not affected (C:N), the high integrity (I:H) and availability (I:H) impact—owing to potential code execution, data corruption, or service crash—warrants immediate visibility and remediation planning. The authentication barrier prevents casual mass exploitation but does not significantly reduce insider or supply-chain attack risk.

Frequently asked questions