RTI Connext Professional CVE-2026-18460

Requires network reachability to an RTI Connext Professional DDS domain running the affected Core Libraries (7.4.0 before 7.7.0.1, or 7.0.0 before 7.3.1.6) and the ability to deliver a crafted DDS/RTPS message that reaches the vulnerable parsing path. Per the CVSS vector no authentication (PR:N) or user interaction (UI:N) is needed. Practical exposure is LIMITED by the fact that DDS middleware is typically deployed on segmented or private operational networks (robotics, autonomous systems, defense/aerospace) rather than directly on the internet, and the flaw yields only partial integrity/availability impact rather than code execution.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes an unauthenticated, network-reachable, low-complexity flaw, but the impact metrics are the story: VC:N/VI:L/VA:L means no confidentiality loss and only PARTIAL integrity and availability impact, yielding a moderate 6.9 (MEDIUM). This is a materially lower-severity issue than several of its RTI Connext siblings (e.g. the 10.0 stack-overflow RCE CVE-2026-7866 or the heap-overflow CVE-2026-18457 with full I:H/A:H), and the CWE-193 off-by-one out-of-bounds write here appears to corrupt a bounded amount of adjacent memory rather than enabling reliable code execution or a hard crash. There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data - exploitation status is 'no public exploit identified at time of analysis.' The single reference is RTI's own self-published advisory page, so all details are vendor-self-reported and not independently corroborated by NVD analysis or third parties. Realistically this is a lower-priority patch item than the critical siblings: the network vector plus PR:N keeps it on the radar for exposed DDS deployments, but the bounded low-impact write and absence of any exploitation signal argue against emergency treatment. Note the impact ceiling should be verified with RTI - an off-by-one OOB write can sometimes be leveraged beyond the vendor's VI:L/VA:L rating.

An attacker with network reachability to a Connext Professional DDS domain sends a crafted DDS/RTPS message whose length or index field triggers the off-by-one in a Core Libraries parsing routine, writing one or a few bytes past a buffer boundary. This corrupts adjacent memory, producing limited data integrity effects or partial service disruption in the middleware. No public exploit code is available and no active exploitation has been reported.