Externally-Controlled Format String Vulnerability in RTI Connext Professional Core Libraries
CVE-2026-18461

9.2CRITICAL

Key Information:

Vendor

Rti

Status
Connext Professional
Vendor
CVE Published:
22 September 2026

What is CVE-2026-18461?

An externally-controlled format string vulnerability has been identified in RTI Connext Professional, specifically within its Core Libraries. This flaw enables a potential attacker to exploit format string injection, which may lead to unexpected behavior during execution and could compromise the integrity of the application. The affected versions of Connext Professional range from 7.5.0 before 7.7.0.1 and from 7.3.0.10 prior to 7.3.1.6, highlighting the importance of immediate updates to ensure application security.

Affected Version(s)

Connext Professional 7.5.0 < 7.7.0.1

Connext Professional 7.3.0.10 < 7.3.1.6

References

https://www.rti.com/vulnerabilities/#cve-2026-18461

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.