An attacker can craft XML that includes external entity references. When parsed by RTI Connext Professional Core Libraries, the parser attempts to resolve these references, resulting in serialized data external linking and potential exposure of local files or network resources. The flaw is a classic XML External Entity problem described by CWE‑611, and does not provide a direct code‑execution avenue; its primary impact is confidential data leakage.

RTI Connext Professional Core Libraries versions from 4.3x before 5.1.*, from 5.2.0 before 5.2.*, from 5.3.0 before 5.3.*, from 6.0.0 before 6.0.*, from 6.1.0 before 6.1.*, from 7.0.0 before 7.3.1.1, and from 7.4.0 before 7.7.0.

The CVSS score of 6.9 classifies the vulnerability as medium severity while the EPSS score of less than 1% indicates a very low likelihood of exploitation; the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is via any application or service that parses XML input using the affected Connext libraries. Exploitation would involve sending a malicious XML document that triggers the parser to fetch external resources, enabling an attacker to read data they should not see, although no public exploit has been reported.