CVE-2025-4582: RTI Connext Professional Buffer Overflow

CVE-2025-4582 Overview

CVE-2025-4582 is a buffer over-read and off-by-one error in the Core Libraries of RTI Connext Professional. The flaw allows local, authenticated attackers to manipulate files and read beyond allocated buffer boundaries. The vulnerability is classified under [CWE-126: Buffer Over-read].

RTI Connext Professional is a Data Distribution Service (DDS) middleware used in industrial, automotive, aerospace, and defense systems for real-time data exchange. Buffer over-reads in middleware of this class can expose adjacent memory contents that may include sensitive runtime state.

Critical Impact
Local attackers with low privileges can trigger memory over-reads and file manipulation in DDS-based systems, potentially exposing confidential data processed by Connext applications.

Affected Products

RTI Connext Professional 7.4.0 before 7.6.0
RTI Connext Professional 7.0.0 before 7.3.0.8, and 6.1.0 before 6.1.2.26
RTI Connext Professional 6.0.0 before 6.0.1.43, 5.3.0 through 5.3., and 4.4a through 5.2.

Discovery Timeline

2025-09-23 - CVE-2025-4582 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4582

Vulnerability Analysis

The vulnerability combines two related memory-safety defects in the Connext Core Libraries: a buffer over-read and an off-by-one error. An off-by-one condition causes loops or index calculations to reference one element past the intended buffer boundary. When that index is used in a read operation, the process returns bytes from adjacent memory.

Exploitation requires local access and low-level privileges on the host running a Connext application. No user interaction is required. The impact scope covers limited confidentiality loss and limited availability loss on the vulnerable component. Integrity of the process memory is not directly affected by the read primitive itself.

The advisory also notes file manipulation as an outcome, which indicates the flawed code path interacts with on-disk artifacts processed by the middleware. Attackers who chain the over-read with knowledge of process layout may extract configuration data or influence file handling logic.

Root Cause

The root cause is an incorrect boundary check in the Core Libraries, where a loop or size calculation exceeds the allocated buffer by a single element. This off-by-one condition, combined with unbounded read semantics, results in the CWE-126 over-read.

Attack Vector

The attack vector is local. An attacker needs a valid low-privileged account on the system executing Connext Professional. The attacker supplies crafted input to the vulnerable code path — through files or interfaces consumed by the middleware — to trigger the off-by-one read.

No verified proof-of-concept exploit is publicly available for CVE-2025-4582 at time of publication. Refer to the RTI Vulnerability Overview for vendor-supplied technical detail.

Detection Methods for CVE-2025-4582

Indicators of Compromise

Unexpected reads or parsing errors reported by Connext Professional applications in system logs
Anomalous file access patterns by DDS middleware processes toward configuration or QoS profile files
Process crashes or heap corruption traces in Connext-linked binaries during handling of malformed input

Detection Strategies

Inventory all hosts running RTI Connext Professional and correlate installed versions against the affected ranges listed in the vendor advisory
Enable verbose logging in Connext applications to capture parsing errors and abnormal termination events
Deploy runtime memory-safety instrumentation (AddressSanitizer, Valgrind) in development and staging environments to catch off-by-one reads before production deployment

Monitoring Recommendations

Alert on local-user file access to Connext configuration directories from non-service accounts
Monitor endpoint telemetry for crashes of processes linked against Connext Core Libraries
Track privileged account activity on hosts running DDS-based industrial or embedded control workloads

How to Mitigate CVE-2025-4582

Immediate Actions Required

Identify all deployments of RTI Connext Professional across engineering, test, and production environments
Upgrade to a fixed release: 7.6.0 or later for the 7.4.x line, 7.3.0.8 for 7.x, 6.1.2.26 for 6.1.x, or 6.0.1.43 for 6.0.x
Restrict local access to hosts running Connext applications to trusted administrators and service accounts
Review file system permissions on Connext configuration and QoS profile directories

Patch Information

RTI has published fixed versions for each supported release branch. Consult the RTI Vulnerability Overview for the authoritative list of patched builds and upgrade guidance. Versions in the 5.3.x, 5.2.x, and 4.4a through 5.2 ranges remain affected without a listed fix; those deployments should be migrated to a supported branch.

Workarounds

Reduce the number of local accounts on Connext hosts and enforce least-privilege access controls
Isolate Connext Professional workloads on dedicated systems with hardened OS baselines
Apply mandatory access control policies (SELinux, AppArmor) to constrain file operations performed by Connext processes

bash

# Verify installed Connext Professional version on Linux hosts
rtiddsspy -version 2>&1 | grep -i version

# Restrict access to Connext configuration directory
chown -R rti-service:rti-service /opt/rti_connext/
chmod -R 750 /opt/rti_connext/