RTI Connext Professional CVE-2026-7866

No special conditions beyond network reachability - remote unauthenticated exploitation (AV:N/PR:N/UI:N/AC:L/AT:N) against RTI Connext Professional Core Libraries, meaning an attacker only needs to send a crafted message to a reachable Connext/DDS endpoint. The practical limiting factor is network exposure: DDS deployments are frequently on segmented, internal, or isolated real-time data-bus networks rather than the public internet, so exploitation typically requires access to that DDS domain. Affected builds span 7.4.0 before 7.7.0.1, 7.0.0 before 7.3.1.6, and older 6.1/6.0/5.3/5.2/4.3x branches; systems patched to 7.7.0.1 or 7.3.1.6 (or later fixed builds) are not exploitable.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw with no attack requirements, and the vendor rates full CIA compromise of both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H), yielding the maximum 10.0 score. A CWE-121 stack-based buffer overflow of this profile in a core middleware library realistically implies remote code execution, which aligns with the maximal impact metrics. However, key exploitation signals are absent: there is no EPSS score, no CISA KEV listing, no POC, and no SSVC decision data in the input, so exploitation status is 'no public exploit identified at time of analysis.' The single source is RTI's own advisory (self-reported), with no independent NVD enrichment or third-party corroboration provided. Net: severity and exploitability potential are very high, but current real-world exploitation is unproven - treat as urgent to patch given the unauthenticated-network-RCE profile, while noting exploitation activity is not yet evidenced.

An unauthenticated attacker with network reach to a system running RTI Connext (e.g., on a shared DDS data-bus segment) sends a crafted DDS/RTPS network message that overflows a fixed-size stack buffer in the Connext Core Libraries. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low (AC:L), successful exploitation can corrupt the stack and lead to arbitrary code execution in the middleware process, potentially cascading to other subsystems on the data bus (scope change). No public POC is identified at time of analysis.