CVE-2021-38435

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 not correctly calculate the size when allocating the buffer, which may result in a buffer overflow.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-131

Affected software

Vendor	Product	Versions
RTI	Connext DDS Professional	>= 4.2x, <= 6.1.0
RTI	Connext DDS Secure	>= 4.2x, <= 6.1.0

References

https://support.rti.com/s/login/?ec=302&startURL=%2Fs%2FPermissions Required, Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02Third Party Advisory, US Government Resource
https://support.rti.com/s/login/?ec=302&startURL=%2Fs%2FPermissions Required, Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02Third Party Advisory, US Government Resource

Timeline

Published: May 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-384367.8FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could CVE-2021-384387.8A use after free vulnerability in FATEK Automation WinProladder versions 3.30 and prior may be exploited when a valid user opens a malformed CVE-2021-384399.8All versions of GurumDDS are vulnerable to heap-based buffer overflow, which may cause a denial-of-service condition or remotely execute arb CVE-2021-38445.4Rapid7 InsightVM suffers from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged CVE-2021-384403.3FATEK Automation WinProladder versions 3.30 and prior is vulnerable to an out-of-bounds read, which may allow an attacker to read unauthoriz CVE-2021-384419.8Eclipse CycloneDDS versions prior to 0.8.0 are vulnerable to a write-what-where condition, which may allow an attacker to write arbitrary va CVE-2021-384427.8FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could CVE-2021-384439.8Eclipse CycloneDDS versions prior to 0.8.0 improperly handle invalid structures, which may allow an attacker to write arbitrary values in th CVE-2021-384459.8OCI OpenDDS versions prior to 3.18.1 do not handle a length parameter consistent with the actual length of the associated data, which may al CVE-2021-384477.5OCI OpenDDS versions prior to 3.18.1 are vulnerable when an attacker sends a specially crafted packet to flood target devices with unwanted CVE-2021-384487.6The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the i CVE-2021-384499.8Some API functions permit by-design writing or copying data into a given buffer. Since the client controls these parameters, an attacker cou