CVE-2026-2467: RTI Connext Buffer Overflow Vulnerability

CVE-2026-2467 Overview

CVE-2026-2467 is a heap-based buffer overflow [CWE-122] in the Core Libraries of RTI Connext Professional. The flaw permits overflow of variables and tags during message processing. Remote attackers can reach the vulnerable code path over the network without authentication or user interaction. Successful exploitation can corrupt heap memory, impact integrity, and cause denial of service in Data Distribution Service (DDS) deployments that rely on Connext Professional.

Critical Impact
Unauthenticated network attackers can trigger heap memory corruption in RTI Connext Professional Core Libraries, threatening the availability and integrity of DDS-based systems used in industrial, autonomous, and mission-critical environments.

Affected Products

RTI Connext Professional 7.4.0 before 7.7.0
RTI Connext Professional 7.0.0 before 7.3.1.3, 6.1.0 through 6.1.x, 6.0.0 through 6.0.x
RTI Connext Professional 5.3.0 through 5.3.x and 5.0.0 through 5.2.x

Discovery Timeline

2026-06-17 - CVE-2026-2467 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-2467

Vulnerability Analysis

The vulnerability resides in the RTI Connext Professional Core Libraries, which implement the Data Distribution Service (DDS) middleware used for real-time publish-subscribe communication. The flaw is classified as a heap-based buffer overflow affecting how the library handles variables and tags during message parsing. An attacker who can send crafted DDS traffic to a vulnerable participant can write beyond the bounds of a heap allocation, corrupting adjacent memory structures. The impact extends across confidentiality, integrity, and availability of subsystems that depend on Connext Professional for inter-process or inter-host communication.

Root Cause

The root cause is improper validation of size or length fields associated with variable and tag elements before they are copied into a heap-allocated buffer. When attacker-controlled input specifies a length larger than the destination buffer, the copy operation overflows the heap region. This class of flaw, tracked as [CWE-122], commonly leads to memory corruption, crashes, and in some cases code execution depending on the heap allocator and adjacent objects.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker capable of reaching a DDS participant using a vulnerable Connext Professional version can deliver a malformed message containing oversized variable or tag content. Because DDS is often deployed on internal segments with permissive trust assumptions, exposure increases when participants communicate across less trusted network boundaries or expose discovery traffic broadly.

No verified proof-of-concept code is publicly available. Refer to the RTI Vulnerability Overview for vendor-supplied technical details.

Detection Methods for CVE-2026-2467

Indicators of Compromise

Unexpected crashes, segmentation faults, or restarts of processes linked against RTI Connext Professional Core Libraries.
Malformed RTPS (Real-Time Publish-Subscribe) packets containing abnormally large variable or tag length fields on UDP ports used by DDS discovery and data traffic.
Heap corruption signatures in core dumps or crash telemetry from DDS-enabled applications.

Detection Strategies

Inventory all hosts running Connext Professional and compare installed versions against the affected ranges listed by RTI.
Deploy network-layer inspection on RTPS traffic to flag oversized or out-of-spec serialized parameter list entries.
Correlate application crash events with inbound DDS traffic sources to identify potential exploitation attempts.

Monitoring Recommendations

Enable verbose logging in DDS participants where supported, and forward logs to a centralized analytics platform for anomaly detection.
Monitor for unusual DDS discovery traffic from unexpected peers, particularly across network boundaries.
Track process stability metrics for services that link Connext Professional Core Libraries and alert on repeated abnormal terminations.

How to Mitigate CVE-2026-2467

Immediate Actions Required

Upgrade RTI Connext Professional to version 7.7.0 or to a fixed branch release identified by RTI for the 7.0.x, 6.1.x, 6.0.x, 5.3.x, and 5.0.x–5.2.x lines.
Restrict network reachability of DDS participants to trusted segments and authorized peers only.
Audit applications statically linked against vulnerable Core Library versions and rebuild them against patched releases.

Patch Information

RTI has published vulnerability details and remediation guidance on the RTI Vulnerability Overview page. Customers should consult RTI directly for the specific patched build mapped to their licensed version branch.

Workarounds

Enforce DDS Security with authentication, access control, and cryptographic protection to limit which peers can deliver messages to vulnerable participants.
Apply network segmentation and host firewall rules to block RTPS traffic from untrusted sources.
Disable or restrict DDS discovery across untrusted network boundaries until patched versions are deployed.

bash

# Example: restrict RTPS traffic (default UDP 7400-7500 range) to trusted subnets
iptables -A INPUT -p udp --dport 7400:7500 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p udp --dport 7400:7500 -j DROP