Read the docs
TI-2024-34936 Aliases CVE-2024-52060GHSA-7q77-4259-6r93

Potential stack overflow when using XML configuration file referencing environment variables

Priority MEDIUM 42CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routing Service, Recording Service, Queuing Service, Observability Collector Service, Cloud Discovery Service) allows Buffer Overflow via Environment Variables.This issue affects Connext Professional: from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.1.45.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00314 24th percentileScored 2026-11-07
Fix Fixed Connext Professional (RTI): 7.3.0.5, 6.1.2.21, 6.0.1.40 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
RTIConnext Professional7.0.0 to before 7.3.0.5; 6.1.0 to before 6.1.2.21; 6.0.0 to before 6.0.1.40; 5.3.0 to before 5.3.1.457.3.0.5, 6.1.2.21, 6.0.1.40, 5.3.1.45Patch availableCNA
  • Connext Professional VendorRTI Affected 7.0.0 to before 7.3.0.5; 6.1.0 to before 6.1.2.21; 6.0.0 to before 6.0.1.40; 5.3.0 to before 5.3.1.45 Fixed in 7.3.0.5, 6.1.2.21, 6.0.1.40, 5.3.1.45 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:*5.3.0 to before 5.3.1.45; 6.0.0 to before 6.0.1.40; 6.1.0 to before 6.1.2.21; 7.0.0 to before 7.3.0.5VulnerableRTI
  • cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:* Versions 5.3.0 to before 5.3.1.45; 6.0.0 to before 6.0.1.40; 6.1.0 to before 6.1.2.21; 7.0.0 to before 7.3.0.5 Vulnerable ·RTI

Remediation

  • Fix · CNA Connext Professional (RTI) Fixed in 7.3.0.5, 6.1.2.21, 6.0.1.40, 5.3.1.45

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    RTI Connext Professional 5.3.1.45, 6.0.1.40 and 2 more versions

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-34939 Potential stack buffer write overflow in Connext applications while parsing malicious XML types documentPriority MEDIUM 42
    • TI-2024-34938 Potential stack buffer write overflow in Connext applications while parsing malicious XML types documentPriority LOW 30
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-52060
  2. 2026-10-03 Alias added: GHSA-7q77-4259-6r93

References

Advisory 1

  • TI-2021-16087 Potential Network Amplification and Information Exposure in RTI Connext Professional and Connext Micro CVSS 4.0HIGH 8.8
  • TI-2026-03368 Out-of-bounds read in RTI Connext Professional CVSS 4.0CRITICAL 9.2
  • TI-2026-02096 Heap-based buffer overflow in RTI Connext Professional CVSS 4.0CRITICAL 9.2
  • TI-2024-34933 SQL injection in RTI Connext Professional CVSS 4.0CRITICAL 9.1
  • TI-2021-16038 RTI Connext DDS Professional and Connext DDS Secure Incorrect Calculation of Buffer Size CVSS 3.1CRITICAL 9.8
  • TI-2026-06407 Buffer overflow in RTI Connext Professional CVSS 4.0HIGH 8.8
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences