CVE-2026-18458
Received
Received - Intake
Out-of-bounds Read in RTI Connext Professional
Vulnerability report for CVE-2026-18458, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-09-22
Last updated on: 2026-09-22
Assigner: RTI
Description
Description
Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.3.0 before 7.3.1.6, from 6.1.2.21 before 6.1.*.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rti | connext_professional | From 7.4.0 (inc) to 7.7.0.1 (exc) |
| rti | connext_professional | From 7.3.0 (inc) to 7.3.1.6 (exc) |
| rti | connext_professional | From 6.1.2.21 (inc) to 6.1.* (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-843 | The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. |
| CWE-685 | The product calls a function, procedure, or routine, but the caller specifies too many arguments, or too few arguments, which may lead to undefined behavior and resultant weaknesses. |
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
