CVE-2026-18460: RTI Connext Professional Buffer Overflow

CVE-2026-18460 Overview

CVE-2026-18460 is an off-by-one error leading to an out-of-bounds write in the Core Libraries of RTI Connext Professional. The flaw affects Connext Professional versions from 7.4.0 before 7.7.0.1 and from 7.0.0 before 7.3.1.6. A remote, unauthenticated attacker can send crafted network traffic to trigger a buffer overflow condition in the affected middleware. The issue is tracked under CWE-193: Off-by-one Error and is exploitable over the network with no user interaction required.

Critical Impact
A remote attacker can trigger an out-of-bounds write in RTI Connext Professional Core Libraries, potentially impacting the integrity and availability of Data Distribution Service (DDS) based systems.

Affected Products

RTI Connext Professional 7.4.0 through versions before 7.7.0.1
RTI Connext Professional 7.0.0 through versions before 7.3.1.6
RTI Connext Professional Core Libraries

Discovery Timeline

2026-09-22 - CVE-2026-18460 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-18460

Vulnerability Analysis

RTI Connext Professional is a connectivity framework built on the Object Management Group (OMG) Data Distribution Service (DDS) standard. It is used in industrial, aerospace, medical, and autonomous systems for real-time data exchange between distributed nodes. The Core Libraries handle message parsing, discovery, and transport, exposing network-facing code paths.

The vulnerability is an off-by-one error that results in an out-of-bounds write beyond the bounds of an allocated buffer. Off-by-one conditions typically occur when loop bounds, size calculations, or terminator handling miscount by a single byte. Writing one byte past a heap or stack buffer can corrupt adjacent metadata, function pointers, or control data. Impact focuses on integrity and availability rather than confidentiality, based on the vulnerability metrics.

Root Cause

The root cause is classified as CWE-193: Off-by-one Error combined with an out-of-bounds write. The defective code likely miscalculates a boundary condition in a buffer-handling routine within the Core Libraries, permitting a single byte to be written outside the intended memory region. Refer to the RTI Vulnerability Advisory CVE-2026-18460 for vendor-supplied technical details.

Attack Vector

Exploitation occurs over the network with low attack complexity and requires no privileges or user interaction. An attacker able to reach the DDS participant on the target network can send a malformed packet that triggers the flawed boundary computation. DDS deployments frequently span multicast segments, expanding the potential reachability of the vulnerable service. Because Connext is widely used in cyber-physical systems, the practical impact depends on how tightly integrated the middleware is with safety-relevant components.

No public proof-of-concept exploit code has been observed for CVE-2026-18460 at time of publication.

Detection Methods for CVE-2026-18460

Indicators of Compromise

Unexpected crashes, restarts, or assertion failures in RTI Connext Professional applications or rtiddsspy participants.
Malformed Real-Time Publish-Subscribe (RTPS) packets on UDP ports typically in the 7400–7500 range used by DDS discovery and user traffic.
Anomalous DDS participant announcements from unknown GUIDs or unexpected network segments.

Detection Strategies

Inventory all hosts and embedded devices running RTI Connext Professional and compare installed versions against 7.7.0.1 and 7.3.1.6.
Deploy network intrusion detection signatures for malformed RTPS submessages targeting Connext participants.
Enable Connext logging at a verbosity that captures parser errors and correlate with process termination events.

Monitoring Recommendations

Monitor east-west traffic on OT and IoT segments where DDS traffic flows, alerting on unexpected external sources.
Track process stability metrics for critical DDS-enabled applications to identify repeated crashes indicative of exploitation attempts.
Ingest host and network telemetry into a centralized data lake to correlate participant crashes with upstream network events.

How to Mitigate CVE-2026-18460

Immediate Actions Required

Upgrade RTI Connext Professional to version 7.7.0.1 or later on the 7.4.x–7.6.x branch.
Upgrade RTI Connext Professional to version 7.3.1.6 or later on the 7.0.x–7.3.x branch.
Restrict network reachability of DDS participants to trusted segments and authorized peers only.

Patch Information

RTI has released fixed versions 7.7.0.1 and 7.3.1.6 that address CVE-2026-18460. Review the RTI Vulnerability Advisory CVE-2026-18460 for full remediation guidance, applicable Connext components, and downgrade considerations.

Workarounds

Enable RTI Security Plugins to enforce authentication, access control, and cryptographic protection on DDS domains where supported.
Segment DDS traffic using VLANs or firewalls, blocking RTPS traffic (UDP 7400–7500 by default) from untrusted networks.
Disable unused transports and constrain discovery peers using the initial_peers and accept_unknown_peers configuration to reduce exposure to unauthenticated packets.

bash

# Example: restrict RTPS discovery to a defined peer list in USER_QOS_PROFILES.xml
# <participant_qos>
#   <discovery>
#     <initial_peers>
#       <element>udpv4://10.10.20.15</element>
#       <element>udpv4://10.10.20.16</element>
#     </initial_peers>
#     <accept_unknown_peers>false</accept_unknown_peers>
#   </discovery>
# </participant_qos>