CVE-2026-18457: RTI Connext Professional Buffer Overflow

CVE-2026-18457 Overview

CVE-2026-18457 is a heap-based buffer overflow [CWE-122] in the RTI Connext Professional Core Libraries. The flaw affects the Data Distribution Service (DDS) middleware used in industrial, aerospace, defense, and autonomous systems. An unauthenticated remote attacker can overflow heap buffers by sending crafted network traffic to a vulnerable Connext endpoint. Successful exploitation compromises integrity and availability of the target process.

The issue affects Connext Professional versions from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, and multiple older 6.x, 5.x branches. RTI published a vulnerability advisory tracking the fix on September 22, 2026.

Critical Impact
Remote, unauthenticated attackers can corrupt heap memory in Connext Professional processes, enabling denial of service and potential code execution against DDS-based systems.

Affected Products

RTI Connext Professional Core Libraries 7.4.0 through versions before 7.7.0.1
RTI Connext Professional Core Libraries 7.0.0 through versions before 7.3.1.6
RTI Connext Professional Core Libraries 5.2.3 through 6.1.x (all sub-releases in these branches)

Discovery Timeline

2026-09-22 - CVE CVE-2026-18457 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-18457

Vulnerability Analysis

RTI Connext Professional implements the Object Management Group (OMG) DDS standard for real-time publish-subscribe messaging. The Core Libraries parse Real-Time Publish-Subscribe (RTPS) protocol messages received over the network. A heap-based buffer overflow condition in this parsing path allows an attacker to write beyond the bounds of a heap-allocated buffer.

The advisory classifies the weakness as CWE-122, indicating that attacker-controlled data reaches a memory copy operation without adequate bounds enforcement. Because Connext participants typically listen on well-known DDS discovery ports, an attacker on the same network segment can reach the vulnerable code path without authentication or user interaction.

Exploitation of a heap overflow in a native C/C++ middleware layer can corrupt adjacent heap metadata and application data. Attackers may leverage this to crash the process, disrupt real-time data flows, or manipulate control-plane state.

Root Cause

The root cause is insufficient validation of length or size fields within RTPS message processing inside the Core Libraries. When the library allocates a heap buffer based on one value but copies data governed by an attacker-controlled length, memory beyond the allocation is overwritten. Full technical details are restricted to the vendor advisory.

Attack Vector

The attack vector is network-based. An attacker sends a crafted DDS/RTPS message to a listener on a Connext participant. No credentials are required. The advisory notes an attack requirement (AT:P) indicating that specific runtime conditions must be present for reliable exploitation. Confirmed impact is on integrity and availability; confidentiality is not directly affected per the CVSS vector.

See the RTI Vulnerability Report for CVE-2026-18457 for vendor-provided technical detail.

Detection Methods for CVE-2026-18457

Indicators of Compromise

Unexpected crashes, segmentation faults, or restarts of Connext participant processes on hosts running affected library versions.
Anomalous inbound RTPS traffic to DDS discovery or user-traffic ports (UDP 7400-7500 range by default) from unexpected sources.
Heap corruption signatures in crash dumps or core files originating from RTI Connext libraries.

Detection Strategies

Inventory all hosts running RTI Connext Professional and enumerate Core Libraries versions against the affected ranges.
Deploy network monitoring for malformed RTPS packets, particularly those with inconsistent length fields relative to payload size.
Enable and forward application crash telemetry from DDS participants to a central logging platform for correlation.

Monitoring Recommendations

Alert on repeated abnormal termination of processes linking against libnddscore or equivalent Connext runtime libraries.
Baseline expected DDS peers and flag participants originating from unauthorized IP addresses or subnets.
Capture full packet metadata for DDS-carrying VLANs to enable retrospective analysis if exploitation is suspected.

How to Mitigate CVE-2026-18457

Immediate Actions Required

Upgrade Connext Professional 7.4.x deployments to version 7.7.0.1 or later.
Upgrade Connext Professional 7.0.0 through 7.3.x deployments to version 7.3.1.6 or later.
For 6.1.x, 6.0.x, 5.3.x, and 5.2.3+ branches, contact RTI for supported upgrade paths, since fixes for these older branches are constrained per the advisory.
Restrict network reachability of DDS participants to trusted segments until patching completes.

Patch Information

RTI has released fixed versions 7.7.0.1 and 7.3.1.6 addressing CVE-2026-18457. Refer to the RTI Vulnerability Report for CVE-2026-18457 for the authoritative list of fixed releases and download instructions. Customers on end-of-life branches should engage RTI support to determine migration options.

Workarounds

Enable DDS Security with authentication and access control to reject unauthenticated RTPS traffic from unknown participants.
Segment DDS traffic onto dedicated VLANs and enforce firewall rules that limit RTPS ports to known participant addresses.
Disable or restrict multicast discovery where feasible and use configured peer lists to limit exposed attack surface.

bash

# Example: restrict RTPS traffic to trusted DDS peer subnet
iptables -A INPUT -p udp --dport 7400:7500 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 7400:7500 -j DROP