RTI Connext Professional CVE-2026-18457

Exploitation requires network reachability to a DDS domain in which a vulnerable RTI Connext Professional participant (Core Libraries) is processing RTPS/DDS traffic - i.e., the target must be listening on and accepting DDS wire-protocol messages from the attacker's network position. No authentication (PR:N) and no user interaction (UI:N) are required, but the CVSS 4.0 AT:P flag indicates a specific attack requirement/precondition (a particular message state or sequence) must hold, so exploitation is not unconditional. Limiting factors: DDS traffic is frequently confined to isolated OT/robotics/simulation networks rather than the open internet, and only the listed version branches are affected (7.4.0 before 7.7.0.1; 7.0.0 before 7.3.1.6; and the 6.1/6.0/5.3/5.2.3 branches).

This is a genuinely serious but not five-alarm issue. The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H) describes an unauthenticated, network-reachable heap-based buffer overflow (CWE-122) in RTI Connext Professional core DDS libraries with high integrity and availability impact but NO confidentiality impact (VC:N) and no scope change to subsequent systems. Two signals temper the raw 8.3 score: (1) the AT:P 'Attack Requirements' flag indicates exploitation is not purely at-will and depends on a specific condition or state, which is why the score sits at 8.3 rather than ~9.3; (2) there is NO EPSS score, NO CISA KEV listing, and NO public POC in the supplied intelligence, so this is no public exploit identified at time of analysis - not confirmed exploitation. The only reference is the vendor's own self-reported advisory (rti.com), so severity and affected-version data are single-sourced and not independently corroborated by NVD or CISA. Net: prioritize patching for any deployment that exposes DDS traffic to untrusted networks (memory-corruption bugs in middleware handling attacker-controlled network data are realistically weaponizable for RCE despite the conservative VC:N/no-scope rating), but this is not a mass-exploitation emergency - it reads as a vendor-disclosed hardening fix rather than an actively-abused threat.

An attacker with network reachability to a DDS domain sends crafted RTPS/DDS wire traffic that a Connext Professional participant parses, overflowing a heap buffer in the core libraries to corrupt memory and crash the participant or achieve code execution. Because the CVSS 4.0 vector is PR:N/UI:N, no credentials or victim interaction are needed, but the AT:P flag means a specific condition (e.g., a particular message sequence or participant state) must be met. No public exploit code is identified at time of analysis.