CVE-2025-14543 is a critical (9.1) XML external entity flaw in the core libraries of RTI Connext Professional. Applications that parse malicious XML can be made to link external data. The record lists fixes in 7.7.0 and 7.3.1.1 for newer lines, so check RTI bulletin RTI-SB-2026-03 for your version.
What's affected
The record says Connext Professional is affected from 7.4.0 before 7.7.0, and from 7.0.0 before 7.3.1.1. It also lists older lines, 6.1.0, 6.0.0, 5.3.0, 5.2.0 and 4.3x, with ranges ending in wildcards that are not clear. For those lines, read the vendor bulletin.
RTI lists the issue in security bulletin RTI-SB-2026-03 with the title Potential external entity attack (XXE) in Connext applications when parsing malicious XML files, rated Critical. The part of the bulletin with versions and mitigations was not available to me when I read it, so use it to confirm.
The CVSS vector is AV:N/AC:L/PR:N/UI:N with high confidentiality and availability impact.
How to check if you're exposed
Check the Connext version your applications use.
- Look at the Connext installation directory name and the version shown by the RTI launcher or admin tools.
- Check the libraries linked into your applications, since Connext is often shipped inside products as a core library.
- Identify where your applications load XML, such as QoS profiles, type definitions and configuration files, and who can write those files.
- Ask the vendors of products that embed Connext whether they ship an updated build.
What to do now
- List the applications and products that embed RTI Connext, and their versions.
- Open RTI-SB-2026-03 on the RTI vulnerabilities page and note the fixed versions for your line.
- Upgrade to a fixed release and rebuild or redeploy your applications.
- Restrict who can supply or change XML files that your applications load.
- Ask embedded product vendors for updated builds.
Why it matters
The weakness is CWE-611, improper restriction of XML external entity reference. An XML parser that resolves external entities can be told to pull content from files or network locations that an attacker names.
Connext is used for data distribution in systems such as medical devices, industrial controls and vehicles. XML configuration there is often trusted, which is why the risk depends on who can write those files. Control over those files and over the update process matters as much as the library version.
Quick check
What do I need to confirm in the bulletin?
The fixed versions for your product line, because the record lists several lines with unclear ranges.
Sources
Last reviewed: 19 October 2026.
