A double free bug in the core libraries of RTI Connext Professional permits an attacker who can trigger the fault to manipulate files arbitrarily. The flaw is classified as CWE-415, a classic example of improper memory deallocation that can corrupt program state or overwrite critical data structures. While no remote code execution is advertised, the ability to rewrite files undermines the integrity of the application and could be leveraged to subvert configuration or workaround controls.

The vulnerability affects RTI Connext Professional (Core Libraries) from version 7.4.0 up to but not including 7.7.0.1, and from 7.1.0 up to but not including 7.3.1.6. Any deployment using these releases is potentially impacted.

With a CVSS score of 6.9, the flaw presents a moderate severity assessment. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation to date. The likely attack vector is local or network via an application that communicates with the Connext middleware, with the attacker needing to exercise a specific sequence that causes the double free. Because the flaw can modify file contents, its exploitation could be strategic and subtle rather than immediate.