RTI Connext Professional CVE-2026-18461

Requires network reachability to a DDS domain where a vulnerable RTI Connext Professional participant (Core Libraries, versions 7.5.0 to before 7.7.0.1, or 7.3.0.10 to before 7.3.1.6) is running, and the attacker must get externally-controlled input to flow into a format-string sink. Exploitation is unauthenticated (PR:N) and needs no user interaction (UI:N), but is limited by high attack complexity (AC:H) - the attacker must reliably control the data that reaches the vulnerable formatting routine. Realistic exposure is bounded by DDS deployment topology: Connext participants are typically on segmented robotics/industrial/defense networks rather than the open internet, so reachability to the DDS domain is the primary gating condition.

This is a genuine high-severity issue but with meaningful real-world mitigating factors. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores 9.2 and reflects an unauthenticated, network-reachable format string flaw with high confidentiality, integrity and availability impact to the vulnerable system (no scope change: SC:N/SI:N/SA:N). The single most important tempering signal is AC:H - the attacker must reliably route externally-controlled data into a format-string sink, which raises exploitation complexity above a trivial single-packet trigger. No exploitation-maturity signals are present: EPSS is not provided, this is NOT in CISA KEV, and no public POC is identified - so this is no public exploit identified at time of analysis, not confirmed active exploitation. SSVC decision inputs (exploitation status, automatable, technical impact) are not supplied in the input. The single source is a self-reported RTI advisory (rti.com); there is no independent NVD enrichment, no corroborating reference, and the format-string outcome (potential code execution vs. crash/info-leak) is not spelled out - the 'Code Injection' tag and CWE-134 imply RCE potential but the advisory does not confirm reliable arbitrary code execution. Net: prioritize patching for exposed DDS deployments, but the AC:H complexity and absence of any exploitation-in-the-wild signal argue against emergency out-of-band response versus a high-CVSS product like OpenSSL/Exchange.

An attacker with network reachability to a DDS domain running a vulnerable Connext Professional participant sends crafted DDS traffic (e.g. a field or identifier that later reaches a logging/formatting routine) containing format-string specifiers. Because the format string is externally controlled (CWE-134), the specifiers are interpreted by the underlying C-style formatting function, enabling memory disclosure or memory corruption that can lead toward code execution. No public exploit code is identified, and the high attack complexity (AC:H) means the attacker must reliably get their input into the vulnerable format sink.