CVE-2026-2394

Executive Summary

CVE-2026-2394 is a Buffer Over-read vulnerability in RTI Connext Professional Core Libraries, affecting multiple versions across the 4.3x to 7.6.x range. The flaw allows an attacker to trigger an overread of memory buffers, potentially leading to information disclosure or denial of service. The vulnerability resides in the DDS (Data Distribution Service) middleware, which is widely used in real-time, mission-critical systems such as industrial control, autonomous vehicles, and defense applications.

Key Risk: Exploitation could allow an unauthenticated attacker to read sensitive memory contents or crash the service, impacting confidentiality and availability. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low active exploitation.

Supply Chain & Package Security: RTI Connext Professional is a proprietary middleware library distributed via RTI’s official channels. No open-source package (NPM, PyPI, Go, Ruby) is affected. Users should verify the integrity of downloaded binaries and apply vendor patches.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No vector provided)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged
• Confidentiality (C): High (information disclosure)
• Integrity (I): None
• Availability (A): High (potential crash)
• Threat Level: Medium (due to lack of public exploit and low EPSS)

Deep Dive & Mechanics

The vulnerability is a Buffer Over-read (CWE-126) in the RTI Connext Professional Core Libraries. The DDS middleware processes serialized data packets; a malformed or oversized packet can cause the library to read beyond the allocated buffer boundary. This occurs during deserialization of RTPS (Real-Time Publish-Subscribe) messages.

Root Cause: Improper bounds checking when parsing variable-length fields in RTPS submessages. An attacker can craft a packet with a manipulated length field, causing the parser to read past the end of the buffer.

Impact:

• Information Disclosure: Overread may leak adjacent memory contents (e.g., credentials, session keys, or other sensitive data).
• Denial of Service: Overread can cause segmentation faults or infinite loops, crashing the DDS participant.

Affected Components:

• rtiddsgen generated code
• Core libraries (nddscore, nddscomm)
• RTPS protocol implementation

Vulnerable vs. Patched Code

Vulnerable Code (C/C++ example):

// Vulnerable: No bounds check on length field
void parse_submessage(char *buffer, uint32_t length) {
    char *data = buffer + HEADER_SIZE;
    uint32_t payload_len = *(uint32_t*)data; // Attacker-controlled
    // Overread if payload_len > remaining buffer
    process_payload(data + 4, payload_len);
}

Patched Code:

// Patched: Bounds check added
void parse_submessage(char *buffer, uint32_t length) {
    char *data = buffer + HEADER_SIZE;
    uint32_t payload_len = *(uint32_t*)data;
    if (payload_len > length - HEADER_SIZE - 4) {
        // Reject malformed packet
        return;
    }
    process_payload(data + 4, payload_len);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Network access to a vulnerable RTI Connext Professional instance (default port 7400 for RTPS discovery).
• Ability to send raw UDP packets.

Exploitation Steps:

1. Identify target using Shodan dork: port:7400 RTI.
2. Craft a malformed RTPS submessage with an oversized length field.
3. Send the packet to the target’s discovery multicast address (e.g., 239.255.0.1:7400).
4. Monitor for crash or leaked data in response.

Example Python script (conceptual):

import socket
import struct

target_ip = "192.168.1.100"
port = 7400

# Craft malformed RTPS submessage
# RTPS header + submessage with manipulated length
payload = b"\x01\x02\x03\x04" * 100  # Placeholder
length_field = struct.pack("!I", 0xFFFFFFFF)  # Overread trigger
packet = b"\x52\x54\x49\x00" + length_field + payload

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(packet, (target_ip, port))

Blue Team

Detection:

• Monitor for malformed RTPS packets with abnormal length fields.
• Use network intrusion detection (Suricata) to alert on oversized DDS messages.
• Enable RTI Connext logging and watch for RTI_LOG_TYPE_ERROR entries related to buffer overread.

Honeypot:

• Deploy a fake RTI Connext service on a non-critical host to capture exploit attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • UDP packets to port 7400 with payload length > 65535 bytes.
  • RTPS submessages with submessageLength field exceeding 0xFFFF.
• Host IOCs:
  • Crash dumps from nddscore or nddscomm processes.
  • Log entries: "Buffer overread detected" or "Invalid submessage length".
• File IOCs:
  • Modified RTI configuration files (NDDS_QOS_PROFILES.xml) with unusual settings.

Detection Engineering

YARA Rule

rule CVE_2026_2394_RTI_Overread {
    meta:
        description = "Detects malformed RTPS packets exploiting CVE-2026-2394"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $rtps_header = { 52 54 49 00 }  // "RTI\0"
        $large_length = { FF FF 00 00 } // Length > 65535
    condition:
        $rtps_header at 0 and $large_length
}

Sigma Rule

title: CVE-2026-2394 RTI Connext Buffer Overread
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects network traffic exploiting CVE-2026-2394
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 7400
        payload_length: ">65535"
    condition: selection
falsepositives:
    - Legitimate large DDS messages (rare)
level: high

Suricata Rule

alert udp any any -> any 7400 (msg:"CVE-2026-2394 RTI Connext Buffer Overread Attempt"; content:"|52 54 49 00|"; offset:0; depth:4; byte_test:4,>,65535,4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to patched versions:
   • Connext Professional 7.7.0 or later
   • Connext Professional 7.3.1.1 or later
   • Connext Professional 6.1., 6.0., 5.3., 5.2.
2. If upgrade is not possible, restrict network access to RTI DDS ports (7400, 7410) using firewall rules.
3. Enable RTI Connext security plugins (if licensed) to authenticate and authorize participants.

Long-term:

• Implement network segmentation for DDS domains.
• Monitor vendor advisories for permanent patches.
• Conduct code review of custom DDS applications for similar buffer handling issues.

Workaround:

• Set NDDS_QOS_PROFILES.xml to limit maximum submessage size:

<qos_profile name="SecureProfile">
    <participant_qos>
        <resource_limits>
            <max_submessage_size>65535</max_submessage_size>
        </resource_limits>
    </participant_qos>
</qos_profile>

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 9A04543A6310D79E863E7E06] */}