RTI Connext Professional CVE-2026-2467

The attacker needs network-layer reachability to a Connext participant's RTPS endpoint (typically UDP on the configured DDS discovery and user-traffic ports) and the ability to send a crafted RTPS message containing the malformed variables/tags that trigger the heap overflow; per CVSS 4.0 AV:N/AC:L/PR:N/UI:N no authentication, user interaction, or special attack requirements (AT:N) are needed, so default Connext deployments that expose RTPS on a routable interface are directly exploitable. Limiting factors: DDS domains in production are commonly deployed on isolated operational/control networks rather than internet-facing interfaces, and deployments that have enabled the optional DDS Security plugins (authentication/access-control) will reject participants lacking valid credentials before the affected parsing path completes - non-security-enabled configurations on reachable segments are the realistic exposure window.

Signals strongly suggest a high-priority issue: CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and impact metrics VA:H/SA:H show availability damage extends to a subsequent system - consistent with a participant crash cascading into the broader DDS domain. Confidentiality is rated N (VC:N/SC:N), so this is a denial-of-service and integrity-tampering primitive rather than a data-exfiltration bug, though heap overflows of this class often have latent code-execution potential not yet reflected in the vector. Mitigating real-world risk: Connext deployments are typically on segmented operational-technology or backbone networks rather than the public internet, no public exploit identified at time of analysis, no KEV listing, and no EPSS score is provided in the input - so widespread opportunistic exploitation is unlikely, but targeted attacks against exposed DDS domains (e.g., misconfigured discovery on routable interfaces) are credible. Key data missing: no EPSS value, no POC indicator, and the reference list contains only the vendor portal page without a CVSS 3.1 vector for cross-comparison.

An attacker with network reachability to a Connext participant - for example, a compromised host on the same operational segment, or an internet-exposed DDS gateway - sends a crafted RTPS message containing oversized variable or tag fields that the Core Libraries deserialize into an undersized heap allocation. The resulting out-of-bounds write corrupts heap metadata, crashing the participant and disrupting the DDS domain's discovery and data flow; given the subsequent-system availability impact (SA:H), a single malformed packet can cascade into broader middleware outage across publishers and subscribers in the domain. No public exploit identified at time of analysis, so this would currently require attacker-developed tooling against the RTPS wire format.