RTI Connext Micro CVE-2026-30802

The attacker must be able to deliver a crafted RTPS/DDS message to a Connext Micro endpoint running an affected version (4.0.0 ≤ v < 4.3.0) - i.e., network reachability to the UDP ports on which the DDS participant is listening for discovery or user traffic. No authentication, user interaction, or non-default configuration is required per CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N. Realistic limiting factors: Connext Micro is typically deployed on embedded/edge devices inside segmented OT or vehicle networks rather than on internet-facing hosts, and deployments using DDS Security authentication/encryption would require an attacker to first defeat or operate inside that trust boundary.

The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VC:L/VA:H) indicates a network-reachable, unauthenticated, low-complexity flaw whose primary impact is denial of service of the DDS endpoint with a minor confidentiality leak - consistent with a parser-side OOB read that returns stray memory bytes or crashes the consumer. EPSS, KEV, and POC data are all absent from the provided intelligence, so exploitation likelihood cannot be quantitatively scored; the realistic risk is concentrated in environments where Connext Micro endpoints are exposed to untrusted RTPS traffic, which is rare in well-segmented OT/embedded deployments but plausible on flat industrial networks. Note one signal-to-signal tension: vendor-supplied tags include 'Buffer Overflow' and 'Information Disclosure', but CWE-125 and the CVSS impact (VC:L, VI:N) are more consistent with an out-of-bounds *read* than a write - defenders should not assume memory corruption / RCE without further vendor detail.

An attacker with network reachability to a Connext Micro participant sends a malformed RTPS/DDS message with crafted length or sequence fields that cause the Core Libraries to read past the end of a parsing buffer; the resulting behavior is most likely a crash of the subscriber/publisher process (availability impact) or, in some cases, leakage of small fragments of adjacent heap/stack memory back into protocol responses or logs. On a flat OT network where DDS endpoints are reachable from a compromised engineering workstation or rogue device, this could be repeatedly triggered to deny service to critical telemetry consumers. No public exploit identified at time of analysis.