4.23. Vulnerabilities

The following vulnerabilities are fixed in this release.

See also RTI Connext Security Bulletins and Advisories for a complete list of vulnerabilities in RTI releases that have been published through the CVE® Program. That list may be more up-to-date.

4.23.1. [Critical] Potential unauthorized access to instance information in Connext applications

An unauthorized access to instance information in Connext applications could have occurred while setting DDS_ReliabilityQosPolicy::instance_state_consistency_kind to DDS_RECOVER_INSTANCE_STATE_CONSISTENCY on a DataReader.

User Impact without Security

A vulnerability in Connext applications while enabling instance state consistency on a DataReader could have resulted in the following:

User Impact with Security

A vulnerability in Connext applications while enabling instance state consistency on a DataReader could have resulted in the following:

[RTI Issue ID CORE-16119]

4.23.2. [Critical] Potential Denial of Service in Connext applications when parsing XML files

Earlier releases of Connext depended on Expat 2.7.1, which is known to be affected by CVE-2025-59375, a publicly disclosed vulnerability. Release 7.7.0 uses a newer version of Expat that does not have this vulnerability. See the third-party software upgrades in What’s New.

User Impact without Security

This vulnerability could have resulted in the following:

User Impact with Security

This vulnerability could have resulted in the following:

[RTI Issue ID CORE-16200]

4.23.3. [Critical] Potential heap buffer write overflow and memory leak in Connext applications when parsing an XML type

There was a possible heap buffer overwrite and memory leak when parsing an XML type.

User Impact without Security

This vulnerability affected the Core Libraries and all Infrastructure Services that rely on the Core Libraries.

User Impact with Security

Similar to “User Impact without Security”; Security reduces the Attack Vector by protecting the network.

[RTI Issue ID CORE-16507]

4.23.4. [Critical] Potential heap buffer read overflow in Connext applications when parsing an XML type

There was a possible heap buffer overread of one byte when parsing an XML type.

User Impact without Security

This vulnerability could have caused the following on any application using XML types:

User Impact with Security

This vulnerability could have caused the following on any application using XML types:

[RTI Issue ID CORE-16494]

4.23.5. [Critical] Potential out-of-bounds write in Connext when using Durable Writer History

Connext may have written out of bounds when using Durable Writer History.

User Impact without Security

User Impact with Security

Same impact as described in “User Impact without Security” above.

[RTI Issue ID CORE-16252]

4.23.6. [Critical] Potential external entity attack (XXE) in Connext applications when parsing malicious XML files

The Core Libraries XML parser was not resistent against XML External Entity (XXE) attacks.

User Impact without Security

A vulnerability in Connext applications while parsing XML files could have resulted in the following:

User Impact with Security

A vulnerability in Connext applications while parsing XML files could have resulted in the following:

[RTI Issue ID CORE-16328]

4.23.7. [Critical] Potential heap-based buffer overflow when parsing malicious XML configuration files

Connext applications were vulnerable to a heap-based buffer overflow when parsing specially crafted XML documents. This vulnerability, tracked as CVE-2026-25210, existed in the libexpat third-party library. An attacker could exploit this by providing a malicious XML configuration file, potentially leading to an application crash, memory corruption, or arbitrary code execution. The issue was fixed by upgrading libexpat to version 2.7.4.

User Impact without Security

  • Exploitable through a compromised local file system containing malicious XML files.

  • Remotely exploitable through malicious RTPS messages.

  • A heap-based buffer overflow occurred in the doContent function of libexpat. This memory corruption could lead to an application crash (Denial of Service) or potential integrity loss through arbitrary code execution with the privileges of the application process.

  • CVSS v3.1 Base Score: 9.8 CRITICAL

  • CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • CVSS v4.0 Base Score: 9.2 CRITICAL

  • CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

User Impact with Security

  • Exploitable through a compromised local file system containing malicious XML files.

  • While Security Plugins protect against network-based attacks (RTPS), they do not protect the local file system unless the file is a Governance or Permissions Document signed by a Permissions Authority. For standard QoS or configuration files, the impact remained a potential crash or integrity loss.

  • CVSS v3.1 Base Score: 7.8 HIGH

  • CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • CVSS v4.0 Base Score: 8.5 HIGH

  • CVSS v4.0 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

[RTI Issue ID CORE-16539]

4.23.8. [Critical] Potential out-of-bounds read in Core Libraries on invalid XML constant expression

An out-of-bounds read could have happened when processing XML containing a constant whose expression value is ill-formed.

User Impact without Security

This vulnerability affected the Core Libraries.

User Impact with Security

Similar to “User Impact without Security”; Security reduces the Attack Vector by protecting the network.

[RTI Issue ID CORE-16574]