CVE-2026-3894: RTI Connext Buffer Overflow Vulnerability

CVE-2026-3894 Overview

CVE-2026-3894 is an out-of-bounds read vulnerability in the Core Libraries of RTI Connext Professional. The flaw lets remote attackers trigger buffer over-reads across network-exposed Data Distribution Service (DDS) interfaces. The issue is classified under [CWE-125] and affects multiple major release branches of Connext Professional. RTI has assigned a CVSS 4.0 score of 9.2, reflecting high impact on availability and integrity of downstream systems consuming the data.

Critical Impact
Unauthenticated network attackers can read memory beyond intended buffer boundaries, causing process instability and degraded availability of mission-critical DDS-based applications.

Affected Products

RTI Connext Professional 7.4.0 through versions before 7.7.0
RTI Connext Professional 7.0.0 through versions before 7.3.1.3
RTI Connext Professional branches 6.1.x, 6.0.x, 5.3.x, and 5.0.x through 5.2.x

Discovery Timeline

2026-06-17 - CVE-2026-3894 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-3894

Vulnerability Analysis

The vulnerability resides in the Core Libraries that implement the DDS protocol stack inside RTI Connext Professional. Connext Professional is a middleware product used in real-time distributed systems including industrial control, autonomous vehicles, defense platforms, and medical devices. An out-of-bounds read occurs when the library processes a crafted network message and accesses memory beyond the bounds of an allocated buffer. The condition is reachable from the network without authentication or user interaction. While confidentiality impact is not present, the read operation produces invalid data flow and availability loss for components that depend on the affected process.

Root Cause

The defect is a buffer over-read in message parsing or sample handling logic inside the Core Libraries. The code path dereferences memory locations derived from attacker-influenced length or offset fields without sufficient validation against the actual buffer size. This matches the [CWE-125] Out-of-bounds Read weakness pattern.

Attack Vector

A remote attacker sends a malformed DDS message to a participant running a vulnerable version of Connext Professional. The Core Libraries process the message and read past the bounds of an internal buffer. The resulting fault can crash the participant, corrupt downstream integrity checks, or produce incorrect samples consumed by subscribers. No verified public proof-of-concept is currently available. See the RTI CVE-2026-3894 Vulnerability advisory for vendor technical details.

Detection Methods for CVE-2026-3894

Indicators of Compromise

Unexpected crashes or restarts of DomainParticipant processes linked against RTI Connext Core Libraries.
Malformed Real-Time Publish-Subscribe (RTPS) packets logged by network sensors targeting UDP ports used by DDS discovery and user data traffic.
Anomalous sample sequence gaps or integrity errors reported by Connext subscribers.

Detection Strategies

Inventory all hosts running Connext Professional and compare installed library versions against the affected ranges published by RTI.
Inspect RTPS traffic for oversized or truncated submessage length fields that do not match payload boundaries.
Correlate process crash telemetry with inbound DDS network flows to surface targeted exploitation attempts.

Monitoring Recommendations

Enable verbose logging in Connext participants to capture parser errors and abnormal message rejections.
Forward host process exit codes and core dump events from DDS hosts to a centralized analytics platform.
Monitor east-west traffic between DDS participants for unexpected senders outside the documented topology.

How to Mitigate CVE-2026-3894

Immediate Actions Required

Upgrade Connext Professional to version 7.7.0 or 7.3.1.3 according to your current branch.
Restrict network reachability of DDS participants to authorized peers using firewall rules and network segmentation.
Audit all custom applications statically linked against affected Core Libraries and rebuild them against patched releases.

Patch Information

RTI has released fixed versions 7.7.0 and 7.3.1.3 of Connext Professional. Older 6.1.x, 6.0.x, 5.3.x, and 5.0.x–5.2.x branches require migration to a supported fixed release. Consult the RTI CVE-2026-3894 Vulnerability advisory for branch-specific patch packages and upgrade guidance.

Workarounds

Apply DDS Security plugins to enforce authentication and message origin authentication, reducing exposure to anonymous attackers.
Place DDS participants behind dedicated routing daemons such as rtiroutingservice that filter and validate inbound traffic.
Limit DDS discovery to a static peer list to prevent unsolicited participants from sending crafted RTPS messages.

bash

# Configuration example: restrict DDS discovery to known peers via environment variable
export NDDS_DISCOVERY_PEERS="10.0.0.10,10.0.0.11,10.0.0.12"

# Verify installed Connext version against fixed releases
rtipkginstall -listInstalled | grep -i connext