CVE-2026-11389: RTI Connext Professional Buffer Overflow

CVE-2026-11389 Overview

CVE-2026-11389 is an out-of-bounds read vulnerability [CWE-125] in RTI Connext Professional Core Libraries. The flaw combines an out-of-bounds read with a function call using an incorrect number of arguments and a type confusion condition. An authenticated local attacker with low privileges can trigger a buffer over-read that impacts availability of the affected process. The issue affects Connext Professional versions from 7.4.0 before 7.7.0.1, and from 7.3.0 before 7.3.1.6.

Critical Impact
A local low-privileged attacker can crash or destabilize Connext Professional processes that rely on the Core Libraries, disrupting Data Distribution Service (DDS) communications in industrial, defense, and autonomous systems.

Affected Products

RTI Connext Professional 7.4.0 through versions before 7.7.0.1
RTI Connext Professional 7.3.0 through versions before 7.3.1.6
RTI Connext Professional Core Libraries

Discovery Timeline

2026-09-22 - CVE-2026-11389 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in the NVD database

Technical Details for CVE-2026-11389

Vulnerability Analysis

The vulnerability resides in the RTI Connext Professional Core Libraries, which implement the Object Management Group (OMG) Data Distribution Service (DDS) middleware. Three related weaknesses converge: an out-of-bounds read [CWE-125], a function call with an incorrect number of arguments, and an access of a resource using an incompatible type (type confusion). The combined condition allows an attacker to overread buffers beyond their allocated boundaries. Exploitation requires local access and low-privileged authentication on the host running the affected Connext process. Successful exploitation impacts availability only, with no confidentiality or integrity effects reported by the vendor.

Root Cause

The root cause is improper validation of argument counts and type metadata during internal function dispatch inside the Core Libraries. When mismatched arguments or incompatible types are passed to affected routines, the library reads memory past the intended buffer. This overread produces undefined behavior that can terminate the process.

Attack Vector

The attack vector is local. An attacker must already possess low-privilege access to the system hosting the Connext Professional application. From there, the attacker interacts with the affected process, delivering malformed inputs or invoking internal interfaces in a way that triggers the mismatched call. The attack requires no user interaction. Because DDS is often deployed in real-time systems, process termination can cascade into operational disruption. No public proof-of-concept exploit is available at the time of publication.

No verified exploit code has been published. Refer to the RTI Vulnerability Advisory for technical details.

Detection Methods for CVE-2026-11389

Indicators of Compromise

Unexpected termination or repeated restarts of Connext Professional processes and DDS participant applications.
Core dumps or crash reports referencing RTI Connext Core Library modules on affected hosts.
Anomalous local process behavior from low-privileged accounts interacting with DDS endpoints or shared memory transports.

Detection Strategies

Inventory all hosts running RTI Connext Professional and confirm library version against the fixed releases 7.7.0.1 and 7.3.1.6.
Correlate operating system crash telemetry with the presence of Connext binaries to identify potential exploitation attempts.
Monitor local privilege escalation and lateral movement patterns that may precede targeting of middleware processes.

Monitoring Recommendations

Enable process crash and stability logging on hosts that run DDS applications, and forward events to a centralized log platform.
Track user activity on systems that host Connext Professional, focusing on local logons and shell activity by non-administrative accounts.
Baseline normal DDS participant uptime and alert on abnormal restart frequency.

How to Mitigate CVE-2026-11389

Immediate Actions Required

Upgrade RTI Connext Professional to version 7.7.0.1 or later on the 7.4.x branch, or to 7.3.1.6 or later on the 7.3.x branch.
Restrict local access to systems running Connext Professional to trusted administrators and service accounts only.
Audit accounts with local login rights on affected hosts and remove unnecessary access.

Patch Information

RTI has released fixed versions 7.7.0.1 and 7.3.1.6 that address the out-of-bounds read, argument count mismatch, and type confusion conditions in the Core Libraries. Consult the RTI Vulnerability Advisory for the complete patch matrix and upgrade guidance for your deployment.

Workarounds

Apply host-level access controls to prevent unauthorized local users from interacting with Connext processes until patching is complete.
Isolate systems running vulnerable Connext versions in segmented network zones and limit interactive access.
Implement automated process supervision to restart terminated DDS participants and preserve operational continuity during remediation.

bash

# Verify installed RTI Connext Professional version on Linux hosts
rtiddsping -version 2>&1 | grep -i version

# List Connext-related shared libraries loaded on the host
ldconfig -p | grep -i nddscore