5. Release Notes

5.1. Supported Platforms

This release of RTI Connext AUTOSAR Runtime CDD Code Generator supports the following versions with Connext Drive 4.0.1:

Connext Micro 2.4.14.3, the version of Connext Micro included in the Connext Drive 4.0.1 bundle.
Connext Micro 4.3.0.

The AUTOSAR Runtime CDD Code Generator is supported on the following platforms with x64 CPUs:

Ubuntu® Linux® 18.04 LTS (with “g++-9” backport)
Ubuntu Linux 20.04 LTS
RedHat® Enterprise Linux 8 (with “devtoolset-9” toolset)
Windows® 8.1
Windows 10
Windows 11
macOS® version 11.6 (“Big Sur”) and higher

and the following platforms with arm64 CPUs:

macOS® version 11.6 (“Big Sur”) and higher

5.2. What's New in 4.0.1

5.2.1. Third-party software changes

The following third-party software used by the AUTOSAR Runtime CDD Code Generator has been upgraded:

Table 5.1 Third-Party Software Upgrades
Third-Party Software	Old Version	New Version
Expat	2.7.1	2.8.0

5.3. What's Fixed in 4.0.1

5.3.1. Vulnerabilities

5.3.1.1. Potential denial of service in rtiarcgen and rtiaragen when parsing XML files

Earlier releases of the AUTOSAR Toolkit code generators rtiarcgen and rtiaragen depended on libexpat 2.7.1, which is known to be affected by CVE-2025-59375, a publicly disclosed vulnerability. The issue was fixed by upgrading libexpat to version 2.8.0.

User Impact without Security

Exploitable through a compromised local file system containing malicious XML files (e.g., ARXML files provided to rtiarcgen or rtiaragen).
Large dynamic memory allocations when parsing a maliciously crafted small document.
CVSS v3.1 Score: 5.5 Medium
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0 Score: 6.8 Medium
CVSS v4.0 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

User Impact with Security

Same impact as described in "User Impact without Security" above.

5.3.1.2. Potential heap-based buffer overflow when parsing malicious XML provided to rtiarcgen or rtiaragen

AUTOSAR Toolkit code generators rtiarcgen and rtiaragen were vulnerable to a heap-based buffer overflow when parsing specially crafted XML documents. This vulnerability, tracked as CVE-2026-25210, existed in the libexpat third-party library. An attacker could exploit this by providing a malicious XML configuration file, potentially leading to a crash in rtiarcgen or rtiaragen, memory corruption, or arbitrary code execution. The issue was fixed by upgrading libexpat to version 2.8.0.

User Impact without Security

Exploitable through a compromised local file system containing malicious XML files (e.g., ARXML files provided to rtiarcgen or rtiaragen).
A heap-based buffer overflow occured in the doContent function of libexpat. This memory corruption could lead to an application crash (Denial of Service) or potential integrity loss through arbitrary code execution with the privileges of the AUTOSAR Toolkit code generators.
CVSS v3.1 Base Score: 7.8 High
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0 Base Score: 8.5 High
CVSS v4.0 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

User Impact with Security

Same impact as described in "User Impact without Security" above.

5.3.1.3. Potential denial of service in rtiarcgen and rtiaragen when parsing malicious XML configuration files

AUTOSAR Toolkit code generators rtiarcgen and rtiaragen were vulnerable to a denial-of-service attack when parsing specially crafted XML documents. This vulnerability, tracked as CVE-2026-41080, existed in the libexpat third-party library. An attacker could exploit this by providing a malicious XML document — via a malicious local XML configuration file — causing 100% CPU usage on the parsing thread, making the application unresponsive. This issue was fixed by upgrading libexpat to version 2.8.0.

User Impact without Security

Exploitable through a compromised local file system containing malicious XML files (e.g., ARXML files provided to rtiarcgen or rtiaragen).
An algorithmic-complexity weakness in the libexpat symbol-table hashing could be triggered when processing a document containing many crafted element, attribute, or entity names, causing 100% CPU usage on the parsing thread and a Denial of Service (DoS) where the application would hang during configuration load. There was no confidentiality or integrity impact.
CVSS v3.1 Base Score: 3.3 Low
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0 Base Score: 4.8 Medium
CVSS v4.0 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

User Impact with Security

Same impact as described in "User Impact without Security" above.

5.4. Previous Releases

5.4.1. What's New in 4.0.0

There are no changes to the AUTOSAR Runtime CDD Code Generator in release 4.0.0.

5.4.2. What's New in 3.1.1

5.4.2.1. Added support for DDS-XML to ARXML type conversion

Conversion of all DDS-XML supported types to Classic Platform ARXML is now supported, except for the following:

wchar
wstring
string
longDouble
bitfield
sequence

This new feature allows you to automatically port existing DDS type libraries in DDS-XML file format to AUTOSAR ARXML, avoiding a time-consuming and error-prone manual process.

5.4.2.2. Third-party software changes

The following third-party software used by the AUTOSAR Runtime CDD Code Generator has been upgraded:

Table 5.2 Third-Party Software Upgrades
Third-Party Software	Old Version	New Version
Expat	2.6.1	2.6.3

5.4.3. What's Fixed in 3.1.1

5.4.3.1. Crash when application data types were not mapped to implementation or base types

When application data types were not mapped to an implementation or base type, rtiarcgen crashed. Instead of crashing, the parser now displays a warning message when ARXML-defined application data types are not mapped to implementation or base types.

[RTI Issue ID APIT-405]

5.4.3.2. Crash when parsing ARXML data type definitions without CATEGORY element

ARXML base, implementation, or application data types without a CATEGORY element caused rtiarcgen to crash when parsed.

[RTI Issue ID APIT-414]

5.4.4. What's New in 3.1.0

The following third-party software used by the AUTOSAR Runtime CDD Code Generator has been upgraded:

Table 5.3 Third-Party Software Upgrades
Third-Party Software	Old Version	New Version
Expat	2.4.8	2.6.1

5.4.5. What's Fixed in 3.1.0

5.4.5.1. ANSI control characters in non-Xterm environments disturbed log output

Terminal environments not compatible with Xterm ANSI control characters (such as the Windows command prompt) don't use these anymore, resulting in cleaner log output.

[RTI Issue ID APIT-232]

5.4.5.2. ddsTypeSupport flag used incorrect rtiddsgen

Previously, when using the -ddsTypeSupport flag, rtiaragen and rtiarcgen attempted to run rtiddsgen from Connext Micro, assuming it was available in the system's PATH. However, most operating systems check the executable directory first, and in the Connext Professional installation, a different, unsupported version of rtiddsgen is available under $NDDSHOME/bin/.

This issue has been fixed in this release by adding the environment varible RTIDDSGEN_PATH, which you will need to set, with the path to rtiddsgen from Connext Micro, in order to use the flag -ddsTypeSupport.

[RTI Issue ID APIT-281]

5.4.5.3. Crash instead of logging for duplicate model entities

When the same ARXML model entity was defined twice (i.e., same name and package path), rtiarcgen/rtiaragen crashed. Now, these gracefully warn about the duplication, instead of crashing.

[RTI Issue ID APIT-312]

5.4.6. What's New in 3.0.0

5.4.6.1. Production-grade release

This release is the first production-grade version of RTI Connext® AUTOSAR Runtime CDD Code Generator. The version number corresponds to the Connext Drive bundle that it is included in.

5.4.6.2. Added support for Client/Server ports

This release adds support for Client/Server (C/S) ports to the AUTOSAR Runtime CDD Code Generator. This includes an ARXML parser for AUTOSAR Classic C/S interfaces, type generation for C/S interfaces, and C code generation for runnables accessing C/S ports.

5.4.6.3. Improved parsing of enumeration values in COMPU-METHOD type elements

The COMPU-METHOD parser for Classic ARXMLs has been improved to properly parse elements other than <COMPU-CONST><VT> or <SYMBOL>. The value can now be completely omitted, or expressed as <LOWER-LIMIT>, <UPPER-LIMIT>, or both.

5.4.7. What's Fixed in 3.0.0

5.4.7.1. Code generation failed on Windows with IDL include directive

If you generated an IDL type using -idlTypes in a Windows machine and the generated IDL had an #include directive, code generation with -ddsTypeSupport would fail. This is because the #include directive was using backslashes (\), and this is not currently supported by rtiddsgen. This issue has been fixed; all the #include functions in the IDLs are generated using forward slashes (/).

[RTI Issue ID APIT-124]

5.4.7.2. Relationship of some global options not documented

In previous releases, it was not documented that the option -entitiesTemplate requires -entities to be enabled. This has been fixed. See Command Line Parameters for more information.

[RTI Issue ID APIT-228]