CVE-2026-18458: RTI Connext Professional Buffer Overflow

CVE-2026-18458 Overview

CVE-2026-18458 affects RTI Connext Professional Core Libraries. The vulnerability combines three weaknesses: out-of-bounds read [CWE-125], function call with incorrect number of arguments, and access of resource using incompatible type (type confusion). An attacker with local, low-privileged access can trigger buffer over-reads that impact application availability.

RTI Connext Professional is a Data Distribution Service (DDS) middleware used in industrial, aerospace, defense, and autonomous systems for real-time data exchange between distributed components. A memory-safety flaw in its core libraries can disrupt communication between critical processes.

Critical Impact
Local attackers with low privileges can trigger out-of-bounds reads in Connext Professional Core Libraries, causing high availability impact to DDS-based applications.

Affected Products

RTI Connext Professional 7.4.0 before 7.7.0.1
RTI Connext Professional 7.3.0 before 7.3.1.6
RTI Connext Professional 6.1.2.21 before 6.1.*

Discovery Timeline

2026-09-22 - CVE-2026-18458 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-18458

Vulnerability Analysis

The flaw resides in the Connext Professional Core Libraries, which handle serialization, deserialization, and dispatching of DDS messages between participants. Three related weaknesses combine to create the condition: an out-of-bounds read [CWE-125], a function call issued with an incorrect number of arguments, and a type confusion where a resource is accessed using an incompatible type.

When the affected code path processes crafted input, it reads memory beyond the intended buffer boundary. The type confusion allows a value to be interpreted as a different structure, causing the code to compute incorrect sizes or offsets. The availability impact is rated high, while confidentiality and integrity are not affected in the base metric.

Root Cause

The root cause is missing validation of type and argument count before the library dereferences pointers or invokes internal functions. When object types do not match caller expectations, downstream reads extend past allocated buffers. RTI has not published low-level technical details in the public advisory.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker must be able to submit data to a process using the vulnerable Connext Professional Core Libraries. Successful exploitation results in the target application crashing or entering an unstable state, degrading availability of DDS-based services. See the RTI Vulnerability Advisory for CVE-2026-18458 for vendor details.

No verified proof-of-concept code is publicly available for CVE-2026-18458.
Refer to the RTI advisory for technical guidance.

Detection Methods for CVE-2026-18458

Indicators of Compromise

Unexpected termination or crash of processes linked against RTI Connext Professional Core Libraries.
Segmentation faults or access violations recorded in system logs for DDS-based applications.
Disruption of DDS topic communication between participants without a corresponding configuration change.

Detection Strategies

Inventory hosts running Connext Professional and compare installed versions against the affected ranges 7.4.0–7.7.0.0, 7.3.0–7.3.1.5, and 6.1.2.21 and later 6.1.x builds.
Monitor for repeated crash-restart cycles in processes that load Connext Core Libraries such as libnddscore and libnddsc.
Correlate local process crashes with recent DDS message activity to identify malformed input patterns.

Monitoring Recommendations

Collect application crash dumps and enable core-dump analysis on hosts running DDS workloads.
Forward operating system audit logs, application logs, and DDS participant logs to a centralized platform for correlation.
Track local user activity on systems hosting Connext services, since exploitation requires local low-privileged access.

How to Mitigate CVE-2026-18458

Immediate Actions Required

Identify all systems running affected versions of RTI Connext Professional Core Libraries.
Upgrade to a fixed release: 7.7.0.1 for the 7.4.x–7.7.x line, or 7.3.1.6 for the 7.3.x line.
Restrict local access on hosts running Connext until patches are applied, since the vulnerability requires local privileges.
Review DDS participant configurations to ensure only trusted local processes can publish to sensitive topics.

Patch Information

RTI has published fixed versions. Upgrade Connext Professional to 7.7.0.1 or later on the 7.4.x–7.7.x branch, and to 7.3.1.6 or later on the 7.3.x branch. For 6.1.x deployments, consult the RTI Vulnerability Advisory for CVE-2026-18458 for the recommended fix version.

Workarounds

Limit local user accounts on systems that host Connext-based applications to reduce the attack surface.
Apply operating system hardening such as mandatory access controls to constrain processes interacting with DDS libraries.
Isolate DDS participants on dedicated hosts or containers with minimal shared local access.

bash

# Verify installed RTI Connext Professional version on Linux
rtiddsping -version 2>&1 | grep -i version

# Example: list processes currently using Connext core libraries
lsof 2>/dev/null | grep -Ei 'libnddscore|libnddsc|libnddscpp'