CVE-2026-2394

MediumCVSS 6.5/10Last modified Sep 22, 2026

Description

Buffer Over-read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.1, from 6.1.0 before 6.1.2.34, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, from 4.3x before 5.1.*.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-126 CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Apr 1, 2026
Last modified: Sep 22, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-239406.5Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause CVE-2026-239419.4Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request CVE-2026-239425.4Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Tr CVE-2026-239435.3Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Serv CVE-2026-239449.8Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.13.2, unauthenticated requests coul CVE-2026-239466.8Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below i CVE-2026-239479.8Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.CVE-2026-239487.5FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer dereference vulnerability in rdp_write_logo CVE-2026-239498.6jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vul CVE-2026-23959.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Informatics Technology I CVE-2026-239505.9node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling CVE-2026-239515.5SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that only triggers with exa