10.4.21. Vulnerabilities

The following vulnerabilities are fixed in this release.

See also RTI Connext Security Bulletins and Advisories for a complete list of vulnerabilities in RTI releases that have been published through the CVE® Program. That list may be more up-to-date.

10.4.21.1. [Critical] Potential stack buffer underflow in Connext Micro during message processing

User Impact without Security

A vulnerability in Connext Micro core libraries could have resulted in a stack buffer underflow when receiving malicious RTPS messages.

User Impact with Security

There is no impact when enabling certain Security features; see Mitigations for more information.

Mitigations

[RTI Issue ID MICRO-12773]

10.4.21.2. [Critical] Potential out-of-bounds read in Connext Micro during message processing

User Impact without Security

A vulnerability in Connext Micro core libraries could have resulted in an out-of-bounds read when receiving malicious RTPS messages.

User Impact with Security

There is no impact when enabling certain Security features; see Mitigations for more information.

Mitigations

[RTI Issue ID MICRO-12769]

10.4.21.3. [Minor] Potential-man-in-the-middle attack in Micro Application Generator when using Socket Appender in Apache Log4j™

The logging system in Micro Application Generator could be configured to employ the Socket Appender in Apache Log4j, which is affected by the vulnerability CVE-2025-68161.

This vulnerability has been fixed by upgrading Apache Log4j to version 2.25.3.

User Impact without Security

The associated CVE could be exploited by manipulating files in the Connext Micro installation.

User Impact with Security

Same impact as described in “User Impact without Security” above.

[RTI Issue ID MAG-247]