CVE-2026-2674
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Out-of-bounds Write vulnerability in RTI Connext Professional (Queueing Service, Core Libraries, Persistence Service) allows Overflow Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.3, from 6.1.0 before 6.1.*.
Risk Assessment
The vulnerability can lead to memory corruption, application crash, or arbitrary code execution, which could be exploited to take control of the system. This may compromise availability and integrity of services relying on these components.
Recommendation
Upgrade RTI Connext Professional to version 7.7.0 or later (for 7.4.x series), 7.3.1.3 or later (for 7.0.x series), and the appropriate fix for 6.1.x series. Verify the correctness of buffer write operations in critical components.
Other vulnerabilities in RTI Connext Professional
See all- CVE-2026-7866Critical
RTI Connext Professional (Core Libraries) contains a stack-based buffer overflow vulnerability that allows overflow buffers. This issue affects Connext Professional versions from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, and from 4.3x before 5.1.*.
- CVE-2026-18461Critical
Use of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries) allows Format String Injection. This issue affects Connext Professional: from 7.5.0 before 7.7.0.1, from 7.3.0.10 before 7.3.1.6.
- CVE-2026-3894Critical
An out-of-bounds read vulnerability in RTI Connext Professional (Core Libraries) allows buffer overreads. It affects Connext Professional versions from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.3, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, and from 5.0.0 before 5.1.*.
- CVE-2025-14543Critical
An improper restriction of XML external entity reference vulnerability in RTI Connext Professional (Core Libraries) allows serialized data external linking. It affects Connext Professional versions from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.1, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, and from 4.3x before 5.1.*.
- CVE-2026-4374Critical
An improper restriction of XML external entity reference vulnerability in RTI Connext Professional (Recording Service, Routing Service, Queueing Service, Cloud Discovery Service, Observability Collector) allows serialized data external linking and data serialization external entities blowup. It affects Connext Professional versions from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.1, from 6.1.0 before 6.1.2.34, from 6.0.0 before 6.0.*, and from 5.3.0 before 5.3.*.
- CVE-2025-4993Critical
An untrusted pointer dereference vulnerability in RTI Connext Professional (Core Libraries) allows pointer manipulation. It affects Connext Professional versions from 7.4.0 before 7.6.0, from 7.0.0 before 7.3.0.10, from 6.1.0 before 6.1.2.27, from 6.0.0 before 6.0.1.43, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, and from 4.4a before 5.1.*.
- CVE-2025-1255Critical
An untrusted pointer dereference vulnerability in RTI Connext Professional (Core Libraries) allows pointer manipulation. It affects Connext Professional versions from 7.4.0 before 7.6.0 and from 7.2.0 before 7.3.0.9.
- CVE-2026-8849High
Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation. This issue affects Connext Professional: from 7.6.0 before 7.7.0.1.
- CVE-2026-18626Medium
RTI Connext Professional (Core Libraries) has an Out-of-bounds Read vulnerability that allows overread buffers. This affects versions from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, from 5.0.0 before 5.1.*.
- CVE-2026-18462High
Integer Overflow or Wraparound and Improper Access Control vulnerability in RTI Connext Professional (Core Libraries) allows Shared Resource Manipulation. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*.
Original NVD description (English source)
Out-of-bounds Write vulnerability in RTI Connext Professional (Queueing Service,Core Libraries,Persistence Service) allows Overflow Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.3, from 6.1.0 before 6.1.*.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS