CVE-2025-4993 is a critical (CVSS 9.1) untrusted pointer dereference in the Core Libraries of RTI Connext Professional. RTI's bulletin describes it as a potential invalid read memory access in applications during endpoint discovery. Check your version against the fixed releases in RTI's security bulletin and upgrade.
What's affected
RTI Connext Professional, Core Libraries. The record lists these affected ranges:
- 7.4.0 up to but not including 7.6.0.
- 7.0.0 up to but not including 7.3.0.10.
- 6.1.0 up to but not including 6.1.2.27.
- 6.0.0 up to but not including 6.0.1.43.
- 5.3.0, 5.2.0 and 4.4a, each with an upper bound written with a wildcard in the record (5.3., 5.2. and 5.1.*).
The wildcard entries are not clear enough to name an exact fixed build, so check RTI's bulletin for the precise releases and for versions older than 6.0.
RTI Connext is middleware for connecting distributed systems with the DDS standard. Your exposure depends on whether a product you build or run embeds it.
How to check if you're exposed
Find which Connext version your applications use. Look at the installation directory, which is usually named with the version, and at your build files:
find / -maxdepth 4 -type d -name "rti_connext_dds-*" 2>/dev/null
Your SBOMs and dependency manifests are the better source if you keep them. Search for the Connext libraries and their versions, and include the vendors that supply products embedding Connext.
You can also ask suppliers directly, since the library may be statically linked inside a product you did not build. RTI publishes SBOM and VEX documents on its security page that help with that conversation.
What to do now
- Inventory every application that uses RTI Connext Professional and note the version.
- Compare each with the fixed versions in RTI's bulletin for CVE-2025-4993.
- Upgrade to a fixed release for your branch, then rebuild and retest the applications that embed it.
- For third party products that embed Connext, ask the supplier for their status.
- Restrict who can join your DDS domains and send discovery traffic, using network controls and DDS security features where you use them.
- Add the library to your continuous monitoring so the next RTI bulletin matches automatically.
Why it matters
The weakness is CWE-822, untrusted pointer dereference. Code uses a pointer taken from outside data without confirming it points where it should. Bad data from a peer during endpoint discovery can cause the library to read from memory it should not.
The CVSS vector shows a network attack with no privileges and no user interaction, and high impact on confidentiality and availability. In systems where DDS participants are not fully trusted, discovery messages are an input an attacker can reach.
Middleware sits deep inside products, so upgrades need testing and sometimes recertification. Starting the inventory early is the useful step. The record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What does CVE-2025-4993 do?
RTI's bulletin calls it a potential invalid read memory access in Connext applications during endpoint discovery.
Where do I find the fixed versions?
In RTI's security bulletin for the CVE. The record uses wildcard bounds for older branches, so confirm with RTI.
Sources
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in projects you manage.
Last reviewed: 18 October 2026.
