Which versions of RTI Connext Micro are affected by CVE-2026-30802?

RTI Connext Micro Core Libraries versions 4.0.0 through 4.2.x contain an out-of-bounds read vulnerability (CVSS 8.8) that enables remote unauthenticated attackers to crash the DDS middleware process…

How to fix or mitigate CVE-2026-30802?

24 hours: Identify and document all systems running RTI Connext Micro Core Libraries versions 4.0.0-4.2.x by searching application manifests, vendor bills-of-materials, and container registries. 7 days: Validate that RTI Connext Micro version 4.3.0 or later resolves the vulnerability through vendor documentation; prepare and test the upgrade in a non-production environment and schedule change windows with DDS application teams. 30 days: Deploy RTI Connext Micro version 4.3.0 or later to all production systems currently running vulnerable versions.

RTI Connext Micro CVE-2026-30802

Q: What is the CVSS score of CVE-2026-30802?

CVE-2026-30802 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

HIGH

Out-of-bounds Read (CWE-125)

2026-06-17 RTI

Buffer Overflow Information Disclosure Connext Micro Rti

8.8

CVSS 4.0 · Vendor: RTI

Severity by source

Vendor (RTI) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

RTPS is network-reachable with no auth or interaction (AV:N/AC:L/PR:N/UI:N); OOB read yields limited info disclosure (C:L) and likely process crash of the DDS endpoint (A:H), no integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (RTI).

CVSS VectorVendor: RTI

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 18:07 vuln.today

DescriptionCVE.org

Out-of-bounds Read vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers.This issue affects Connext Micro: from 4.0.0 before 4.3.0.

AnalysisAI

Out-of-bounds read in RTI Connext Micro Core Libraries (versions 4.0.0 up to but not including 4.3.0) allows remote unauthenticated attackers to read beyond allocated buffer boundaries, leading to limited information disclosure and a high availability impact (likely process crash of the DDS middleware). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. The CVSS 4.0 base score of 8.8 reflects network reachability of the DDS protocol stack with no privileges or user interaction required.

Technical ContextAI

RTI Connext Micro is a compact implementation of the OMG Data Distribution Service (DDS) standard, designed for resource-constrained and embedded real-time systems such as avionics, automotive, medical devices, and industrial control. It implements the RTPS (Real-Time Publish-Subscribe) wire protocol over UDP for peer-to-peer data exchange. CWE-125 (Out-of-bounds Read) in the Core Libraries indicates the parser or serialization layer reads memory past the end of an intended buffer - typically because a length field, sequence count, or type discriminator from an inbound RTPS message is trusted without sufficient validation. The affected CPE cpe:2.3:a:rti:connext_micro covers the Connext Micro product family rather than a specific edition.

RemediationAI

Upgrade RTI Connext Micro to version 4.3.0 or later, which is the first version outside the affected range per the vendor's own range specification (Vendor-released patch: 4.3.0; consult https://www.rti.com/vulnerabilities/#cve-2026-30802 for the definitive fixed build). Where an in-place upgrade is not immediately possible on embedded targets, compensating controls should include restricting RTPS traffic (UDP, default discovery ports 7400/7401 plus user-traffic ports) to a known allow-list of participant IPs via host or network firewall, placing DDS domains on a dedicated VLAN isolated from general IT networks, and enabling RTI's transport-level security or DDS Security plugins if licensed - each of which adds configuration overhead and, in the case of DDS Security, non-trivial CPU/latency cost on constrained nodes. Disabling or filtering multicast discovery and pinning to unicast peer lists also reduces the attack surface but breaks dynamic discovery scenarios.