CVE-2026-18626
MediumCVSS 6.8Summary
RTI Connext Professional (Core Libraries) has an Out-of-bounds Read vulnerability that allows overread buffers. This affects versions from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, from 5.0.0 before 5.1.*.
Risk Assessment
An attacker could exploit the vulnerability to read data beyond the intended buffer, potentially leading to disclosure of sensitive information or system instability.
Recommendation
Update RTI Connext Professional to version 7.7.0.1 or later (or appropriate for the version line). Check for available security patches.
Other vulnerabilities in RTI Connext Professional
See all- CVE-2026-8849High
Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation. This issue affects Connext Professional: from 7.6.0 before 7.7.0.1.
- CVE-2026-18462High
Integer Overflow or Wraparound and Improper Access Control vulnerability in RTI Connext Professional (Core Libraries) allows Shared Resource Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*.
- CVE-2026-18460Medium
RTI Connext Professional (Core Libraries) has an Off-by-one Error and Out-of-bounds Write vulnerability that allows overflow buffers. This affects versions from 7.4.0 before 7.7.0.1 and from 7.0.0 before 7.3.1.6.
- CVE-2026-18459High
Incorrect Calculation vulnerability in RTI Connext Professional (Core Libraries) allows Abuse Existing Functionality. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, from 4.1x before 5.1.*.
- CVE-2026-18458Medium
RTI Connext Professional (Core Libraries) has an Out-of-bounds Read, Function Call With Incorrect Number of Arguments, and Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that allows overread buffers. This affects versions from 7.4.0 before 7.7.0.1, from 7.3.0 before 7.3.1.6, and from 6.1.2.21 before 6.1.*.
- CVE-2026-18457High
Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.3 before 5.2.*.
- CVE-2026-11389Medium
RTI Connext Professional (Core Libraries) has an Out-of-bounds Read, Function Call With Incorrect Number of Arguments, and Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that allows overread buffers. This affects versions from 7.4.0 before 7.7.0.1 and from 7.3.0 before 7.3.1.6.
- CVE-2026-11388Medium
RTI Connext Professional (Core Libraries) has a Double Free vulnerability that allows file manipulation. This affects versions from 7.4.0 before 7.7.0.1 and from 7.1.0 before 7.3.1.6.
- CVE-2026-7866Critical
RTI Connext Professional (Core Libraries) contains a stack-based buffer overflow vulnerability that allows overflow buffers. This issue affects Connext Professional versions from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, and from 4.3x before 5.1.*.
- CVE-2026-18461Critical
Use of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries) allows Format String Injection. This issue affects Connext Professional: from 7.5.0 before 7.7.0.1, from 7.3.0.10 before 7.3.1.6.
Original NVD description (English source)
Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, from 5.0.0 before 5.1.*.