Which versions of RTI Connext Professional are affected by CVE-2026-3894?

RTI Connext Professional Core Libraries, critical DDS middleware in defense, autonomous vehicle, and industrial deployments, contains a CVSS 9.2 buffer read vulnerability enabling remote…

How to fix or mitigate CVE-2026-3894?

Within 24 hours: Inventory all RTI Connext Professional deployments (product versions and network locations); determine exposure to untrusted networks. Within 7 days: Deploy network segmentation restricting DDS traffic to authenticated, isolated internal networks only; enable enhanced logging on all Connext endpoints; establish real-time monitoring for anomalous data access patterns. Within 30 days: Request patch timeline and security advisories directly from RTI; conduct risk-based analysis of systems requiring immediate migration versus those acceptable for network isolation; evaluate alternative DDS implementations if RTI provides no concrete remediation timeline.

RTI Connext Professional CVE-2026-3894

Q: What is the CVSS score of CVE-2026-3894?

CVE-2026-3894 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

CRITICAL

Out-of-bounds Read (CWE-125)

2026-06-17 RTI

Buffer Overflow Information Disclosure Connext Professional Rti

9.2

CVSS 4.0 · Vendor: RTI

Severity by source

Vendor (RTI) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.3 CRITICAL

Remote unauthenticated RTPS parsing flaw (AV:N/AC:L/PR:N/UI:N); crash and downstream bus impact justify A:H and Scope:Changed; confidentiality not impacted per vendor VC:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H

Primary rating from Vendor (RTI).

CVSS VectorVendor: RTI

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 18:05 vuln.today

DescriptionCVE.org

Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.3, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.0.0 before 5.2.*.

AnalysisAI

Out-of-bounds read in RTI Connext Professional Core Libraries allows remote unauthenticated attackers to read beyond intended buffer bounds, with the CVSS 4.0 vector (9.2 Critical) indicating high availability impact on both the vulnerable component and downstream systems consuming its data. The flaw affects a wide range of Connext Professional releases used as DDS middleware in defense, autonomous, and industrial deployments. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

RTI Connext Professional is the commercial Data Distribution Service (DDS) middleware implementation from Real-Time Innovations, providing the publish/subscribe data bus used across robotics, autonomous vehicles, aerospace/defense, medical, and industrial control systems. The flaw resides in the Core Libraries - the foundational layer that parses and dispatches DDS/RTPS wire-format messages across UDP/TCP transports - and is classified as CWE-125 (Out-of-bounds Read), meaning the parser reads memory past the end of an allocated buffer when handling malformed or unexpected input. Because Core Libraries are linked into every Connext-based application (publishers, subscribers, routing services), the defect propagates to every process that ingests RTPS traffic. The CPE cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:* confirms the entire Connext Professional product line is in scope rather than a single ancillary tool.

RemediationAI

Vendor-released patch: upgrade to Connext Professional 7.7.0 on the 7.4+ branch or to 7.3.1.3 on the 7.0-7.3 branch as listed by RTI at https://www.rti.com/vulnerabilities/#cve-2026-3894; the description does not enumerate fixed builds for the 6.1.x, 6.0.x, 5.3.x, 5.2.x, and 5.0.x lines, so consult the vendor advisory for branch-specific patched versions or migration guidance. Where immediate patching is not possible, restrict RTPS traffic (default UDP 7400/7401 plus the per-domain dynamic port range) to known DDS participants using host or network ACLs, deploy Connext in a segmented enclave so the discovery and user-traffic ports are unreachable from untrusted networks, and enable RTI Security Plugins (DDS Security) to authenticate participants - note that ACLs and segmentation will not protect a peer that is itself compromised on the bus, and enabling DDS Security after the fact may require regenerating certificates and updating QoS profiles across every participant.