CVE-2025-1255 is a Critical (CVSS 9.1) untrusted pointer dereference in RTI Connext Professional Core Libraries. Releases from 7.4.0 before 7.6.0 and from 7.2.0 before 7.3.0.9 are affected. Upgrade to 7.6.0 or 7.3.0.9, or use the security features RTI lists as mitigations.
What's affected
The NVD record lists RTI Connext Professional from 7.4.0 before 7.6.0 and from 7.2.0 before 7.3.0.9. RTI's advisory describes an invalid read in Connext applications that could occur after calling DDS_Subscriber_lookup_datareader to get the built-in publication information and then discovering a DataWriter.
Weakness class: CWE-822 (Untrusted Pointer Dereference).
RTI says the problem is an out-of-bounds read while parsing a malicious RTPS message, that it is remotely exploitable, and that the impact is on confidentiality plus a possible application crash. RTI publishes CVSS 3.1 of 9.1 and CVSS 4.0 of 8.3 (High) for it. The advisory lists older release lines in its general affected-release table for other CVEs; for this CVE, trust the two ranges above.
Fixed versions
The affected ranges end before 7.6.0 and before 7.3.0.9, so those two releases are the fixed versions according to the ranges. Check the RTI advisory for any later notes before you plan the rollout.
How to check if you're exposed
- Find every application or service built with RTI Connext Professional. Include recorders, routers and gateways that ship as separate processes.
- Read the Connext version from your build configuration or from the log output at start-up, and compare it with the two ranges.
- Check whether the application calls DDS_Subscriber_lookup_datareader for built-in publication data, since the advisory ties the bug to that path.
- Check whether RTPS protection, discovery protection or RTPS PSK protection from the Security Plugins is enabled. RTI says there is no impact when certain security features are enabled.
What to do now
- Upgrade affected applications to RTI Connext 7.6.0 or 7.3.0.9, or to a later release, after testing.
- Until you can upgrade, enable the Security Plugins with RTPS protection, discovery protection or RTPS PSK protection, as RTI describes in its mitigations.
- RTI also lists a logging setting: set verbosity to NDDS_CONFIG_LOG_VERBOSITY_WARNING or higher for the NDDS_CONFIG_LOG_CATEGORY_API category. Read the advisory for how this relates to the issue.
- Segment the networks that carry DDS traffic so only trusted participants can reach them.
- Rebuild and redeploy every product that embeds the library, because static or bundled copies will not update on their own.
Why it matters
An untrusted pointer dereference means the code follows a pointer or length taken from data that came from outside. If the value is not checked, the program can read memory it should not touch, which may expose data or crash the process. Message parsing in discovery protocols is a classic place for this, because discovery happens automatically with unknown peers.
Connext is used in industrial, medical and defense systems where a crash has real consequences. That is why the fix and the network controls both matter. The record does not report exploitation in the wild and the CVE is not in the CISA KEV catalog.
Quick check
Do I need to upgrade if I use the Security Plugins?
RTI says there is no impact when RTPS protection, discovery protection or RTPS PSK protection is enabled. Upgrading is still the cleaner fix.
Sources
- RTI Connext security vulnerabilities page
- Safeguard Gold entry for CVE-2025-1255
- NVD record for CVE-2025-1255 (published 23 September 2025), the basis for the scores, weakness classes and affected product data above
Last reviewed: 19 October 2026.
