RTI Connext Professional EUVD-2026-84614

No special product configuration is required - the CVSS vector is AV:N/AC:L/PR:N/UI:N, indicating remote, unauthenticated, low-complexity exploitation of default Connext Professional Core Libraries. The practical prerequisite is network reachability to the DDS/RTPS traffic of a Connext-based application (the DDS domain), so exploitation is limited to attackers who can send data to the affected middleware - typically same-network, VPN, or otherwise routable access to the pub/sub data bus rather than the public Internet. Impact is confined to availability (service disruption); no authentication, user interaction, or non-default feature toggle is needed. Only listed versions are affected; upgrading to fixed builds (e.g. 7.7.0.1, 7.3.1.6, or 5.1.*) removes exposure.

This is a genuine but availability-limited issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with no user interaction - a favorable profile for an attacker - but the impact metrics are availability-only (VA:H) with VC:N and VI:N, meaning this is a denial-of-service, NOT data theft or code execution. The vendor-labeled score of 8.7 (HIGH) is driven almost entirely by the easy attack surface plus full availability loss; the real-world priority is lower than the number suggests because there is no confidentiality or integrity impact. Critically, the input Tag 'Information Disclosure' directly CONTRADICTS the CVSS vector (VC:N = no confidentiality impact) - treat the availability-only vector as authoritative and the tag as mislabeled. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so there is no evidence of active or imminent widespread exploitation. Net: a real, remotely-triggerable DoS in real-time middleware where uptime is often safety-critical, but not a confidentiality/RCE emergency.

A remote, unauthenticated attacker with network reachability to a Connext-based application's DDS/RTPS traffic sends crafted network data that triggers the incorrect calculation (CWE-682) in the Core Libraries, causing the middleware to malfunction or crash and disrupting the real-time data distribution. Because the affected products run in robotics, autonomous-vehicle, aerospace and defense systems, loss of availability can degrade or halt the controlled process. No public proof-of-concept is identified at time of analysis.