Read the docs
TI-2021-16038 Aliases CVE-2021-38435GHSA-wvww-www9-c7jj

RTI Connext DDS Professional and Connext DDS Secure Incorrect Calculation of Buffer Size

Priority MEDIUM 45CWE-131Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-131 and the CVSS impact.

Summary

RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 not correctly calculate the size when allocating the buffer, which may result in a buffer overflow.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01445 73rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
RTIConnext DDS Professional4.2x – 6.1.0—No fix listedCNA
RTIConnext DDS Secure4.2x – 6.1.0—No fix listedCNA
  • Connext DDS Professional VendorRTI Affected 4.2x – 6.1.0 Fixed in — No fix listed CNA
  • Connext DDS Secure VendorRTI Affected 4.2x – 6.1.0 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*4.2 to before 6.1.0VulnerableRTI
cpe:2.3:a:rti:connext_secure:*:*:*:*:*:*:*:*4.2 to before 6.1.0VulnerableRTI
  • cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:* Versions 4.2 to before 6.1.0 Vulnerable ·RTI
  • cpe:2.3:a:rti:connext_secure:*:*:*:*:*:*:*:* Versions 4.2 to before 6.1.0 Vulnerable ·RTI

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-38435
  2. 2026-10-03 Alias added: GHSA-wvww-www9-c7jj

References

Advisory 2

  • TI-2021-16087 Potential Network Amplification and Information Exposure in RTI Connext Professional and Connext Micro CVSS 4.0HIGH 8.8
  • TI-2026-03368 Out-of-bounds read in RTI Connext Professional CVSS 4.0CRITICAL 9.2
  • TI-2026-02096 Heap-based buffer overflow in RTI Connext Professional CVSS 4.0CRITICAL 9.2
  • TI-2024-34933 SQL injection in RTI Connext Professional CVSS 4.0CRITICAL 9.1
  • TI-2026-06407 Buffer overflow in RTI Connext Professional CVSS 4.0HIGH 8.8
  • TI-2024-34942 Potential stack corruption in Routing Service when using a malicious XML configuration document CVSS 4.0HIGH 8.3
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences