CVE-2025-1254

HighCVSS 7.4/10Last modified Sep 22, 2026

Description

Out-of-bounds Read, Out-of-bounds Write vulnerability in RTI Connext Professional (Recording Service) allows Overflow Buffers, Overread Buffers. This issue affects Connext Professional: from 7.4.0 before 7.5.0, from 7.0.0 before 7.3.0.7, from 6.1.0 before 6.1.2.23, from 6.0.0 before 6.0.1.42.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-125 CWE-787

Affected software

Vendor	Product	Versions
RTI	Connext Professional	>= 7.4.0, < 7.5.0; >= 7.0.0, < 7.3.0.7; >= 6.1.0, < 6.1.2.23; >= 6.0.0, < 6.0.1.42

References

https://www.rti.com/vulnerabilities/#cve-2025-1254Vendor Advisory

Timeline

Published: May 8, 2025
Last modified: Sep 22, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-125404.7The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and CVE-2025-125439.6A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fa CVE-2025-125444.8The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious sc CVE-2025-125455.3The Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Infor CVE-2025-125465.4A vulnerability was determined in LogicalDOC Community Edition up to 9.2.1. This affects an unknown part of the component API Key creation U CVE-2025-125478.1A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1. This vulnerability affects unknown code of the file /login.jsp o CVE-2025-125489.0A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret ex CVE-2025-125498.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Rozy - Fl CVE-2025-12559.1Untrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation. This issue affects Con CVE-2025-125508.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes OchaHouse CVE-2025-125517.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins ListingHub listinghub allows CVE-2025-125529.8Insufficient Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.