CVE-2026-7866

CriticalCVSS 10.0/10Last modified Sep 23, 2026

Description

Stack-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, from 4.3x before 5.1.*.

Metrics

CVSS 4.0 10.0/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-121

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
RTI	Connext Professional	>= 7.4.0, < 7.7.0.1; >= 7.0.0, < 7.3.1.6; >= 6.1.0, < 6.1.; >= 6.0.0, < 6.0.; >= 5.3.0, < 5.3.; >= 5.2.0, < 5.2.; >= 4.3x, < 5.1.*

References

https://www.rti.com/vulnerabilities/#cve-2026-7866

Timeline

Published: Sep 22, 2026
Last modified: Sep 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-786607.5Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HT CVE-2026-786617.5When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data +CVE-2026-786627.5Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's CVE-2026-786639.1The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for a CVE-2026-786677.5When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excess CVE-2026-786697.5A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending ma CVE-2026-78677.8A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user CVE-2026-786737.5IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation.CVE-2026-786748.8The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can le CVE-2026-786757.8GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by inclu CVE-2026-786769.8GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values CVE-2026-786777.5GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outsi