RTI Connext Professional EUVD-2026-84609

Exploitation targets the Security Plugins component of RTI Connext Professional in versions 7.6.0 up to (not including) 7.7.0.1, so a deployment must run the Security Plugins add-on rather than the base DDS libraries. The attacker must hold low-level authenticated access to the DDS domain (PR:L) - i.e., be an admitted participant - and the CVSS 4.0 Attack Requirement flag (AT:P) indicates a specific precondition or race/timing state must exist for the use-after-free to be reached, which limits reliable exploitation. No user interaction is required (UI:N) and the vector is network-reachable (AV:N), but the authentication and attack-requirement gates mean this is not exploitable against a default unauthenticated posture.

The CVSS 4.0 base score of 7.7 (High) is vendor-supplied by RTI and rests on a network-reachable (AV:N), low-complexity (AC:L) use-after-free that nonetheless carries an Attack Requirement (AT:P) and requires prior low-privilege authentication (PR:L), with high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H) but no scope change to other systems (SC:N). No EPSS probability, no CISA KEV listing, and no public POC were provided in the intelligence set, so this is 'no public exploit identified at time of analysis' - the score reflects potential technical severity, not observed activity. The signals are internally consistent but modest: authentication plus an attack requirement (AT:P) meaningfully raises the exploitation bar versus a pure unauthenticated network flaw, so despite the High rating this is better treated as a patch-in-normal-cycle issue for affected DDS deployments than an emergency, absent any exploitation evidence. Note a tension worth verifying: the description characterizes the outcome as 'File Manipulation' (an integrity effect) while the Tags emphasize 'Denial Of Service' and 'Memory Corruption'; the true dominant impact of this CWE-416 use-after-free (code execution, DoS, or file tampering) is not disambiguated by the single sparse vendor reference and should be confirmed with RTI's advisory.

A low-privileged authenticated participant on a DDS domain served by RTI Connext Professional Security Plugins sends crafted traffic that triggers a use-after-free in the security plugin's memory handling, corrupting freed objects to manipulate files or crash the service. Because an attack requirement applies (AT:P), the attacker likely needs a specific timing or state condition to reliably win the race. No public exploit code was identified at the time of analysis.