CVE-2026-18626 Overview
CVE-2026-18626 is an out-of-bounds read vulnerability [CWE-125] in RTI Connext Professional Core Libraries. The flaw allows a local authenticated attacker to overread buffer memory, which can cause the Connext process to crash and disrupt Data Distribution Service (DDS) communication. RTI Connext is widely deployed in industrial control, autonomous systems, robotics, medical devices, and defense applications that rely on real-time data exchange.
The vulnerability affects Connext Professional versions from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, and multiple earlier 5.x and 6.x branches.
Critical Impact
Local low-privileged attackers can trigger buffer overreads in Connext Professional, resulting in availability loss for DDS-based real-time messaging systems.
Affected Products
- RTI Connext Professional 7.4.0 before 7.7.0.1
- RTI Connext Professional 7.0.0 before 7.3.1.6
- RTI Connext Professional 5.0.0 through 6.1.x (all sub-versions in the 5.0, 5.2, 5.3, 6.0, and 6.1 branches)
Discovery Timeline
- 2026-09-22 - CVE-2026-18626 published to the National Vulnerability Database
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-18626
Vulnerability Analysis
The vulnerability resides in the Connext Professional Core Libraries, which implement the Object Management Group (OMG) DDS specification. An out-of-bounds read occurs when the library processes input data and accesses memory beyond an allocated buffer boundary. The condition is classified under [CWE-125] Out-of-bounds Read.
Exploitation is limited to local vectors and requires the attacker to already hold low privileges on the host running a Connext application. Successful triggering degrades availability by crashing the affected process, which halts real-time DDS traffic. Confidentiality and integrity impact are not indicated by the vendor scoring.
RTI has addressed the issue in Connext Professional 7.7.0.1 and 7.3.1.6. Users of end-of-life 5.x and 6.0/6.1 branches must plan an upgrade path, as no fixed sub-versions are listed within those major releases.
Root Cause
The root cause is missing or insufficient bounds checking when the Core Libraries parse buffered input. The library reads past the intended data structure boundary, returning memory contents outside the allocation. In this case, the overread destabilizes the process rather than exposing sensitive data.
Attack Vector
The attack vector is local and requires low privileges without user interaction. An attacker with a foothold on the host can supply crafted input to a Connext-linked component or interact with a local DDS participant to trigger the overread. Refer to the RTI Security Vulnerability CVE-2026-18626 advisory for vendor-supplied technical details.
Detection Methods for CVE-2026-18626
Indicators of Compromise
- Unexpected crashes, segmentation faults, or abnormal termination of processes linked to Connext Core Libraries
- Core dumps referencing DDS parsing functions in the affected library versions
- Repeated DDS participant reconnection events without a corresponding network cause
Detection Strategies
- Inventory hosts running Connext Professional and identify installed library versions against the affected version ranges
- Monitor application logs for parser errors, assertion failures, or SIGSEGV signals from Connext-linked binaries
- Correlate local user activity with subsequent Connext process failures to identify possible exploitation attempts
Monitoring Recommendations
- Enable endpoint telemetry for process crashes and unexpected child process termination on hosts running DDS workloads
- Track file access and command execution by non-administrative accounts targeting Connext binaries or configuration files
- Alert on repeated availability disruptions of DDS middleware in operational technology environments
How to Mitigate CVE-2026-18626
Immediate Actions Required
- Upgrade Connext Professional 7.4.x deployments to version 7.7.0.1 or later
- Upgrade Connext Professional 7.0.x through 7.3.x deployments to version 7.3.1.6 or later
- Plan migration for end-of-life 5.x, 6.0.x, and 6.1.x branches, since no in-branch fix is published
- Restrict local access to hosts running Connext applications and enforce least-privilege on service accounts
Patch Information
RTI has released fixed versions 7.7.0.1 and 7.3.1.6 that remediate the out-of-bounds read in the Core Libraries. Consult the RTI Security Vulnerability CVE-2026-18626 advisory for the complete list of fixed builds and upgrade guidance.
Workarounds
- Limit interactive and service account access on hosts running Connext to trusted operators only
- Apply operating system hardening to prevent local privilege reuse against DDS middleware processes
- Isolate Connext workloads on dedicated hosts or containers to reduce local attack surface until patching is complete
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
