CVE-2026-7300: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Web Integration Service) allows Filter Failure through Buffer Overflow.

Synopsis

A classic buffer overflow vulnerability affects the Web Integration Service component of RTI Connext Professional. The flaw is reachable over the network without any authentication, meaning a remote attacker can send a specially crafted input that overwrites adjacent memory. Successful exploitation causes a high-impact availability disruption to the service, while also enabling limited reads and writes to the affected process memory. Patched-image rebuilds at versions 6.1.*, 7.*, and 7.3.1.3 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable Web Integration Service is exposed over the network; an attacker must be able to reach it remotely to send the malformed input.

• AuthenticationNot required

  No credentials or prior authentication are needed to trigger the overflow (PR:N).

• Victim interactionNot required

  The overflow is triggered entirely by attacker-controlled network input; no user action is required (UI:N).

• Attack complexityDetail

  Exploit conditions are straightforward with no race conditions or environment-specific prerequisites required (AC:L, AT:N).

Blast Radius

• Crashes or hangs the Web Integration Service, disrupting DDS-to-web communication for dependent applications (VA:H).
• Reads a limited portion of the affected process's memory, potentially exposing in-flight message content or internal state (VC:L).
• Writes a limited amount of data into adjacent memory within the affected process, with potential to corrupt internal buffers or control structures (VI:L).
• Impact is contained to the local component; no confidentiality, integrity, or availability impact to systems outside the affected host is indicated (SC:N, SI:N, SA:N).