CVE-2026-3894 RTI CVE debrief

Who should care

Users of RTI Connext Professional (Core Libraries) versions from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.3, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, and from 5.0.0 before 5.2.* should be aware of this Out-of-bounds Read vulnerability.

Technical summary

The vulnerability, CVE-2026-3894, is an Out-of-bounds Read issue in RTI Connext Professional (Core Libraries) that can lead to Overread Buffers. It affects multiple versions of Connext Professional, including those from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.3, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, and from 5.0.0 before 5.2.*. The CVSS score for this vulnerability is 9.2, indicating a Critical severity level. Users should review their deployments and apply patches or updates accordingly.

Defensive priority

High

Recommended defensive actions

• Inventory and verify affected RTI Connext Professional (Core Libraries) versions
• Apply vendor patches or updates to affected versions
• Implement compensating controls to monitor and restrict access to vulnerable systems
• Monitor for potential Overread Buffers attacks
• Review and verify affected product deployments in managed environments
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-06-17T18:17:44.287Z and was last modified on 2026-06-17T20:20:10.920Z. The NVD entry is currently Undergoing Analysis. The vulnerability affects multiple versions of Connext Professional, including those from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.3, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, and from 5.0.0 before 5.2.*. Users should verify their deployments and apply patches or updates accordingly.

Official resources