RTI Connext Professional CVE-2026-11388

Requires LOCAL access to a host running an affected RTI Connext Professional build (7.4.0-7.7.0.0 or 7.1.0-7.3.1.5) plus low-level authenticated privileges (PR:L) sufficient to feed input into the Core Libraries; no user interaction is needed (UI:N). Exploitation is bounded by the local attack vector (AV:L) - it is NOT remotely reachable - and impact is confined to integrity and availability of the affected participant (VC:N, no data theft; SC:N, no impact to other systems). Fixed versions 7.7.0.1 and 7.3.1.6 remove exposure.

This is a moderate-severity, genuinely local-only issue that should NOT be prioritized as a remote threat. The vendor CVSS 4.0 vector (6.9) is unambiguously local: AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H, meaning an attacker needs local access and low-level authenticated privileges, and the impact is limited to integrity (VI:H) and availability (VA:H) with NO confidentiality impact (VC:N) and no scope change (SC:N). This directly contradicts the 'Information Disclosure' tag on the record - a double free with VC:N does not disclose information; it corrupts memory affecting file/data integrity and availability, consistent with the 'File Manipulation' phrasing and CWE-415. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data provided. Net assessment: a legitimate but lower-tier local integrity/DoS bug in a niche middleware product - real priority only for operators of affected robotics/DDS deployments, not a broad emergency. Conflict to verify with vendor: the record's 'Information Disclosure' classification is inconsistent with the CVSS confidentiality metric (VC:N).

A low-privileged local user or a compromised co-located process on a host running RTI Connext Professional supplies crafted input that triggers the double-free condition in the Core Libraries, corrupting heap memory during file/resource handling. This lets the attacker manipulate data integrity or crash the DDS participant (denial of service). No public proof-of-concept exploit is identified in the available data, and exploitation requires prior local authenticated access.