CVE-2024-52066: RTI Connext Buffer Overflow Vulnerability

CVE-2024-52066 Overview

CVE-2024-52066 is a classic buffer overflow vulnerability in the Routing Service component of RTI Connext Professional. The flaw stems from copying input into a buffer without validating its size, allowing remote attackers to overflow internal variables and tags. The issue maps to [CWE-120] (Buffer Copy without Checking Size of Input) and [CWE-787] (Out-of-bounds Write). Successful exploitation can corrupt memory within the Routing Service process, affecting the integrity and availability of distributed Data Distribution Service (DDS) deployments built on Connext.

Critical Impact
Network-reachable attackers can trigger an out-of-bounds write in the Routing Service, leading to process compromise or denial of service across DDS-based systems.

Affected Products

RTI Connext Professional 7.4.0 before 7.5.0
RTI Connext Professional 7.0.0 before 7.3.0.5
RTI Connext Professional 6.1.0 before 6.1.2.21 and 6.0.0 before 6.0.1.40

Discovery Timeline

2024-12-13 - CVE-2024-52066 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52066

Vulnerability Analysis

The vulnerability resides in the Routing Service of RTI Connext Professional, a middleware used to bridge and forward DDS traffic between domains and transports. The Routing Service copies untrusted input into fixed-size buffers used for internal variables and tag handling without enforcing length checks. An attacker who can deliver crafted DDS messages to the service can write beyond the allocated buffer boundary, corrupting adjacent memory structures. Because Connext is widely used in robotics, autonomous systems, industrial control, and defense platforms, exploitation can cascade through interconnected DDS participants.

Root Cause

The root cause is missing bounds validation on input copied into stack or heap buffers within the Routing Service code path that processes variables and tags. The implementation trusts the size of incoming fields, violating the safe-copy contract expected of network-facing parsers. This pattern is captured by [CWE-120] and the resulting memory write corresponds to [CWE-787].

Attack Vector

The attack vector is network-based and requires no authentication or user interaction, although exploitation depends on attacker-controlled conditions reaching the vulnerable parser. An adversary with reachability to the Routing Service can send specially crafted DDS payloads containing oversized variables or tag values. The resulting overflow can crash the service or, depending on memory layout and mitigations, enable further memory corruption against the Connext process.

No verified proof-of-concept code is publicly available for this vulnerability. Refer to the RTI Vulnerability Advisory for vendor-supplied technical context.

Detection Methods for CVE-2024-52066

Indicators of Compromise

Unexpected crashes, restarts, or core dumps of the Connext Routing Service (rtiroutingservice) process.
Anomalously large DDS discovery or user-data messages directed at Routing Service endpoints.
New or unusual inbound connections to Routing Service ports from hosts outside the trusted DDS domain.

Detection Strategies

Inspect Routing Service logs for parser errors, abnormal termination, or assertion failures around variable and tag processing.
Baseline normal DDS message sizes and alert on outliers that approach or exceed protocol field limits.
Correlate process crashes with preceding network flows to identify potential exploitation attempts.

Monitoring Recommendations

Enable verbose logging on Routing Service instances and forward logs to a centralized analytics platform.
Monitor host telemetry for memory faults and unexpected child processes spawned by Connext binaries.
Track patch state of all Connext Professional installations against the fixed version inventory.

How to Mitigate CVE-2024-52066

Immediate Actions Required

Upgrade Connext Professional to a fixed release: 7.5.0, 7.3.0.5, 6.1.2.21, or 6.0.1.40 depending on the deployed branch.
Restrict network reachability of Routing Service endpoints to trusted DDS participants only, using firewalls or network segmentation.
Audit which systems host Routing Service and prioritize patching of internet- or partner-exposed instances.

Patch Information

RTI has published fixed versions and an advisory at RTI Vulnerability CVE-2024-52066. Apply the appropriate maintenance release for each active Connext branch and validate the upgraded rtiroutingservice version after deployment.

Workarounds

Disable the Routing Service on hosts where it is not required until patches are applied.
Enforce DDS Security authentication and access control to prevent unauthenticated peers from reaching the vulnerable parser.
Place Routing Service behind a network access control layer that restricts source addresses to known DDS domain participants.

bash

# Verify installed Connext Routing Service version
rtiroutingservice -version

# Example firewall rule (Linux nftables) restricting Routing Service access
nft add rule inet filter input ip saddr != 10.20.0.0/16 tcp dport 7400-7500 drop