CVE-2025-1254
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Out-of-bounds Read, Out-of-bounds Write vulnerability in RTI Connext Professional (Recording Service) allows Overflow Buffers, Overread Buffers. This issue affects Connext Professional: from 7.4.0 before 7.5.0, from 7.0.0 before 7.3.0.7, from 6.1.0 before 6.1.2.23, from 6.0.0 before 6.0.1.42.
Risk Assessment
The vulnerability can lead to memory corruption, application crash, or arbitrary code execution in the process context. This could be exploited to take control of the system or cause a denial of service.
Recommendation
Upgrade RTI Connext Professional to version 7.5.0 or later (for 7.4.x series), 7.3.0.7 or later (for 7.0.x series), 6.1.2.23 or later (for 6.1.x series), and 6.0.1.42 or later (for 6.0.x series). Verify the integrity of data processed by the Recording Service.
Other vulnerabilities in RTI Connext Professional
See all- CVE-2026-7866Critical
RTI Connext Professional (Core Libraries) contains a stack-based buffer overflow vulnerability that allows overflow buffers. This issue affects Connext Professional versions from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, and from 4.3x before 5.1.*.
- CVE-2026-18461Critical
Use of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries) allows Format String Injection. This issue affects Connext Professional: from 7.5.0 before 7.7.0.1, from 7.3.0.10 before 7.3.1.6.
- CVE-2026-3894Critical
An out-of-bounds read vulnerability in RTI Connext Professional (Core Libraries) allows buffer overreads. It affects Connext Professional versions from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.3, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, and from 5.0.0 before 5.1.*.
- CVE-2025-14543Critical
An improper restriction of XML external entity reference vulnerability in RTI Connext Professional (Core Libraries) allows serialized data external linking. It affects Connext Professional versions from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.1, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, and from 4.3x before 5.1.*.
- CVE-2026-4374Critical
An improper restriction of XML external entity reference vulnerability in RTI Connext Professional (Recording Service, Routing Service, Queueing Service, Cloud Discovery Service, Observability Collector) allows serialized data external linking and data serialization external entities blowup. It affects Connext Professional versions from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.1, from 6.1.0 before 6.1.2.34, from 6.0.0 before 6.0.*, and from 5.3.0 before 5.3.*.
- CVE-2025-4993Critical
An untrusted pointer dereference vulnerability in RTI Connext Professional (Core Libraries) allows pointer manipulation. It affects Connext Professional versions from 7.4.0 before 7.6.0, from 7.0.0 before 7.3.0.10, from 6.1.0 before 6.1.2.27, from 6.0.0 before 6.0.1.43, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, and from 4.4a before 5.1.*.
- CVE-2025-1255Critical
An untrusted pointer dereference vulnerability in RTI Connext Professional (Core Libraries) allows pointer manipulation. It affects Connext Professional versions from 7.4.0 before 7.6.0 and from 7.2.0 before 7.3.0.9.
- CVE-2026-8849High
Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation. This issue affects Connext Professional: from 7.6.0 before 7.7.0.1.
- CVE-2026-18626Medium
RTI Connext Professional (Core Libraries) has an Out-of-bounds Read vulnerability that allows overread buffers. This affects versions from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, from 5.0.0 before 5.1.*.
- CVE-2026-18462High
Integer Overflow or Wraparound and Improper Access Control vulnerability in RTI Connext Professional (Core Libraries) allows Shared Resource Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*.
Original NVD description (English source)
Out-of-bounds Read, Out-of-bounds Write vulnerability in RTI Connext Professional (Recording Service) allows Overflow Buffers, Overread Buffers. This issue affects Connext Professional: from 7.4.0 before 7.5.0, from 7.0.0 before 7.3.0.7, from 6.1.0 before 6.1.2.23, from 6.0.0 before 6.0.1.42.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS