Which versions of RTI Connext Micro are affected by CVE-2026-30803?

RTI Connext Micro middleware deployments on versions 4.0.0-4.2.x are vulnerable to remote attacks by unauthenticated network adversaries, enabling unauthorized access to sensitive application data…

How to fix or mitigate CVE-2026-30803?

Within 24 hours: Inventory all systems running RTI Connext Micro 4.0.0-4.2.x; assess network accessibility and business criticality of each deployment. Within 7 days: Implement network segmentation to restrict access to affected systems via firewall rules; air-gap or disable the service if operationally feasible. Within 30 days: Monitor RTI vendor advisories for patch release; validate and deploy version 4.3.0 or later when available; document mitigation status for audit/compliance.

RTI Connext Micro CVE-2026-30803

Q: What is the CVSS score of CVE-2026-30803?

CVE-2026-30803 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

HIGH

Integer Underflow (CWE-191)

2026-06-17 RTI

Information Disclosure Integer Overflow Connext Micro Rti

8.8

CVSS 4.0 · Vendor: RTI

Severity by source

Vendor (RTI) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Remote RTPS message processed with no auth or UI (AV:N/AC:L/PR:N/UI:N); buffer over-read leaks memory (C:H) and underflow can crash the participant (A:H); no integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (RTI).

CVSS VectorVendor: RTI

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 18:07 vuln.today

DescriptionCVE.org

Integer Underflow (Wrap or Wraparound) vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers.This issue affects Connext Micro: from 4.0.0 before 4.3.0.

AnalysisAI

Remote information disclosure and denial of service in RTI Connext Micro core libraries (versions 4.0.0 through 4.2.x) allow unauthenticated network attackers to trigger an integer underflow that results in an out-of-bounds buffer overread. Exploitation requires no authentication or user interaction and can leak sensitive memory contents while potentially crashing the affected process. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

RTI Connext Micro is a lightweight DDS (Data Distribution Service) middleware implementation from Real-Time Innovations, designed for resource-constrained embedded systems such as autonomous vehicles, robotics, medical devices, and defense platforms. The flaw is rooted in CWE-191 (Integer Underflow / Wraparound) within the Core Libraries, where a value used as a length or offset wraps around past zero into a very large unsigned value. That wrapped value is then used to bound a memory read, producing an over-read of an adjacent buffer (CWE-126-like behavior). Because DDS publish/subscribe traffic is typically processed over UDP from peers on the data bus, the parsing code path is reachable to any peer that can speak RTPS to the participant - per CPE cpe:2.3:a:rti:connext_micro:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade RTI Connext Micro to version 4.3.0 or later, which is the first release outside the vulnerable 4.0.0-4.2.x range per the vendor advisory at https://www.rti.com/vulnerabilities/#cve-2026-30803. Where an immediate upgrade is not feasible - common for safety-certified embedded deployments - restrict DDS/RTPS traffic to trusted participants only by enforcing network segmentation on the data bus, blocking unsolicited RTPS (default UDP 7400-7500 range) at the perimeter, and enabling DDS Security authentication and access control plugins so unauthenticated peers cannot deliver crafted samples to the parser; the trade-off is additional configuration burden, key management, and potential latency overhead from secure DDS. Monitoring for unexpected participant discovery or malformed RTPS submessages on the bus provides limited detection until patched.