CVE-2026-11388: RTI Connext Professional Use-After-Free

CVE-2026-11388 Overview

CVE-2026-11388 is a double free vulnerability [CWE-415] in the RTI Connext Professional Core Libraries. The flaw affects Connext Professional versions from 7.4.0 before 7.7.0.1 and from 7.1.0 before 7.3.1.6. Exploitation allows an authenticated local attacker to manipulate files, corrupting integrity and availability of the affected component. The issue is tracked by RTI in the RTI Vulnerability advisory for CVE-2026-11388.

Critical Impact
A local attacker with low privileges can trigger memory corruption in Connext Professional Core Libraries, resulting in file manipulation that compromises system integrity and availability.

Affected Products

RTI Connext Professional 7.4.0 through versions before 7.7.0.1
RTI Connext Professional 7.1.0 through versions before 7.3.1.6
RTI Connext Professional Core Libraries

Discovery Timeline

2026-09-22 - CVE CVE-2026-11388 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-11388

Vulnerability Analysis

The vulnerability resides in the Core Libraries of RTI Connext Professional, a middleware implementation of the Data Distribution Service (DDS) standard used in real-time and mission-critical systems. A code path frees the same memory region twice, producing an exploitable double free condition. Successful exploitation allows an attacker to influence file operations performed by the vulnerable process.

The attack requires local access and low privileges on the target host. User interaction is not required. Impact is limited to the vulnerable component, but integrity and availability within that scope are high.

Root Cause

The root cause is a memory management defect classified under [CWE-415]. The library releases a heap allocation and then releases the same pointer a second time without clearing or invalidating it between operations. The second free() corrupts allocator metadata, enabling controlled manipulation of subsequent memory or file-handling behavior.

Attack Vector

An attacker executes code locally on a system running an affected Connext Professional version. By triggering the vulnerable code path in the Core Libraries, the attacker forces the double free and leverages the resulting heap corruption to alter files handled by the process. Because the attack requires no user interaction, malicious local processes running under a low-privileged account can invoke the vulnerable API path directly.

No public proof-of-concept exploit is available at the time of publication. Refer to the RTI Vulnerability advisory for CVE-2026-11388 for vendor-supplied technical details.

Detection Methods for CVE-2026-11388

Indicators of Compromise

Unexpected crashes, segmentation faults, or heap corruption errors originating in Connext Professional Core Library processes.
Unauthorized modification, replacement, or deletion of files owned by or accessed by DDS-based applications.
Local user accounts spawning processes that repeatedly load or interact with Connext Professional libraries outside normal application workflows.

Detection Strategies

Inventory hosts running RTI Connext Professional and confirm installed versions against the vulnerable ranges 7.4.0 to 7.7.0.1 and 7.1.0 to 7.3.1.6.
Enable core dump collection on Connext-dependent hosts and review dumps for double free signatures such as free(): double free detected in tcache or glibc malloc_consolidate aborts.
Correlate process crash telemetry with file integrity monitoring alerts to identify manipulation attempts tied to library faults.

Monitoring Recommendations

Deploy file integrity monitoring on directories written to by Connext Professional applications and alert on unexpected changes.
Monitor local authentication and process execution logs for low-privileged accounts interacting with DDS middleware binaries.
Forward endpoint telemetry, crash events, and file modification events to a centralized data lake for correlation and retention.

How to Mitigate CVE-2026-11388

Immediate Actions Required

Upgrade RTI Connext Professional to version 7.7.0.1 or later on the 7.4.x through 7.7.x branch.
Upgrade to version 7.3.1.6 or later on the 7.1.x through 7.3.x branch.
Restrict local access to hosts running Connext Professional and audit which accounts can execute DDS-linked binaries.
Review file permissions on directories accessed by Connext processes and enforce least privilege.

Patch Information

RTI has released fixed versions 7.7.0.1 and 7.3.1.6. Consult the RTI Vulnerability advisory for CVE-2026-11388 for exact upgrade paths, supported platforms, and any additional patch guidance from the vendor.

Workarounds

If immediate patching is not feasible, restrict local logon rights on affected hosts to trusted administrators only.
Apply mandatory access control policies such as SELinux or AppArmor to confine Connext Professional processes and limit file write scope.
Isolate systems running vulnerable versions on dedicated network segments until patched.

bash

# Configuration example
# Verify installed RTI Connext Professional version on Linux
rtiddsping -version 2>&1 | grep -i version

# Restrict execution of Connext binaries to a trusted group
chown root:rti-trusted /opt/rti_connext_dds/bin/*
chmod 750 /opt/rti_connext_dds/bin/*