CVE-2026-3894: Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.

Synopsis

An out-of-bounds read vulnerability exists in the Core Libraries of RTI Connext Professional, a middleware platform commonly used in real-time and safety-critical distributed systems. The flaw is reachable over the network without any authentication, meaning a remote attacker can trigger it by sending a crafted message. Successful exploitation gives the attacker limited write capability on the affected system and causes a high-impact disruption to availability, effectively crashing or destabilizing the service. A patched-image rebuild is available on HarborGuard for environments running any affected version of Connext Professional.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service is exposed over the network; an attacker must be able to send crafted packets to a reachable Connext Professional endpoint to trigger the overread.

• AuthenticationNot required

  No credentials or session token are needed; the attacker can target the service as an unauthenticated remote party.

• Victim interactionNot required

  No user action is required; the attacker sends a malformed message directly to the service without any social-engineering step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environment-specific preconditions.

Blast Radius

• Crashes or destabilizes the affected Connext Professional service, causing a high-severity loss of availability for any system depending on that middleware instance.
• Allows the attacker limited modification of data in the local system scope, meaning some persisted or in-flight values can be tampered with during exploitation.
• Downstream systems in the same distributed architecture that rely on Connext Professional for real-time data exchange inherit the availability disruption at high severity.
• The out-of-bounds read itself may expose regions of process memory to the attacker, potentially leaking internal state used to craft further exploitation attempts.