CVE-2026-18461: RTI Connext Professional Format String Vulnerability

CVE-2026-18461 Overview

CVE-2026-18461 is a format string vulnerability in the Core Libraries of RTI Connext Professional. The flaw stems from the use of an externally-controlled format string [CWE-134], which allows an attacker to inject format specifiers into a function that interprets them. Successful exploitation can lead to memory disclosure, memory corruption, or arbitrary code execution within the affected process. The issue affects Connext Professional versions 7.5.0 before 7.7.0.1 and 7.3.0.10 before 7.3.1.6. The vulnerability is network-exploitable and requires no authentication or user interaction.

Critical Impact
Network-reachable format string injection in a widely deployed Data Distribution Service (DDS) middleware, with high impact to confidentiality, integrity, and availability.

Affected Products

RTI Connext Professional Core Libraries 7.5.0 through versions before 7.7.0.1
RTI Connext Professional Core Libraries 7.3.0.10 through versions before 7.3.1.6

Discovery Timeline

2026-09-22 - CVE-2026-18461 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-18461

Vulnerability Analysis

RTI Connext Professional is a Data Distribution Service (DDS) middleware widely used in autonomous systems, defense, industrial control, and robotics. The affected Core Libraries provide the runtime for DDS publishers, subscribers, and discovery.

The vulnerability arises when the Core Libraries pass externally supplied data directly into a formatting function without a fixed format string. An attacker who can reach the DDS endpoint over the network can craft input containing format specifiers such as %s, %x, or %n. The formatter then interprets these specifiers against the process stack or heap.

Because DDS deployments typically run without user interaction and often communicate across trust boundaries, an unauthenticated remote attacker can trigger the flaw by sending crafted DDS traffic to a listening participant.

Root Cause

The root cause is classified under [CWE-134]: Use of Externally-Controlled Format String. A logging, error-reporting, or serialization routine inside the Core Libraries forwards attacker-controlled data as the format argument of a printf-family call instead of treating it as a bare string operand.

Attack Vector

Exploitation is remote and network-based. An attacker sends DDS packets or protocol fields containing format specifiers to a vulnerable Connext participant. Depending on how the format string is consumed, results range from information disclosure of stack memory to controlled writes that can be chained into code execution. No credentials or user interaction are required.

No verified proof-of-concept code is publicly available. Refer to the RTI Security Advisory CVE-2026-18461 for vendor-provided technical details.

Detection Methods for CVE-2026-18461

Indicators of Compromise

DDS traffic containing format specifier sequences (%s, %x, %n, %p) in string fields such as topic names, participant names, or user data payloads.
Unexpected crashes, segmentation faults, or restarts of Connext-based applications correlated with inbound network activity.
Anomalous log entries from Connext Core Libraries containing malformed or truncated strings.

Detection Strategies

Inspect DDS discovery and user traffic for string fields containing printf-style format tokens that would not appear in legitimate application data.
Correlate process crashes on hosts running Connext with the source IP of inbound RTPS (Real-Time Publish-Subscribe) traffic.
Inventory endpoints running Connext Professional and compare installed versions against the fixed releases 7.7.0.1 and 7.3.1.6.

Monitoring Recommendations

Enable verbose logging in Connext participants during triage and forward logs to a centralized data lake for pattern matching.
Monitor RTPS traffic (default UDP ports in the 7400 range) for unexpected sources, particularly across trust boundaries.
Alert on repeated abnormal terminations of DDS-based services, which may indicate exploitation attempts.

How to Mitigate CVE-2026-18461

Immediate Actions Required

Upgrade Connext Professional 7.5.0–7.7.0 deployments to version 7.7.0.1 or later.
Upgrade Connext Professional 7.3.0.10–7.3.1.5 deployments to version 7.3.1.6 or later.
Restrict DDS traffic to trusted network segments using firewall rules and network segmentation until patching is complete.
Enable RTI DDS Security (authentication, access control, and encryption) on all participants that support it.

Patch Information

RTI has released fixed versions 7.7.0.1 and 7.3.1.6 of the Connext Professional Core Libraries. Refer to the RTI Security Advisory CVE-2026-18461 for download links and version-specific upgrade guidance.

Workarounds

Isolate Connext participants on dedicated VLANs and block RTPS ports at perimeter and internal firewalls.
Require mutual authentication and transport encryption via the RTI Security Plugins to reject untrusted DDS peers.
Validate and sanitize application-level string inputs that are forwarded into DDS topics or participant metadata.

bash

# Example: restrict DDS/RTPS traffic to a trusted subnet using iptables
iptables -A INPUT -p udp --dport 7400:7500 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 7400:7500 -j DROP