CVE-2026-30803 is a critical flaw (CVSS 9.1) in RTI Connext Micro, the compact DDS middleware. In versions from 4.0.0 up to but not including 4.3.0, an integer underflow when handling a malicious data submessage allows a buffer overread. The vendor's fix is Connext Micro 4.3.0.
What's affected
The NVD record and RTI's advisory list Connext Micro from 4.0.0 before 4.3.0 as affected. RTI's advisory page, published June 17, 2026 and updated September 22, 2026, gives the same range and labels it Critical. The vendor says it is exploitable through malicious RTPS messages sent to an application that receives data submessages.
RTI also lists related Connext Micro issues in the same release, such as CVE-2026-30802, so read the full advisory when you plan the upgrade.
How to check if you're exposed
Find which Connext Micro version your product is built with. It is linked into your application, so look at your build files, SDK directory or the version string your binary reports:
strings your_app_binary | grep -i 'connext micro'
If your device or application is a product from a third party, ask that vendor which Connext Micro version it ships. Also list which network segments carry RTPS traffic to these devices.
What to do now
- Rebuild your applications against Connext Micro 4.3.0 or later and redeploy them.
- Until then, use RTI's mitigations from the advisory. It names enabling the Lightweight Security plugin or protecting the network against unauthorized access.
- Restrict who can send RTPS traffic to your devices with network segmentation and firewall rules.
- Ask suppliers of embedded devices for their Connext Micro version and upgrade plan.
- Add Connext Micro to your software inventory so version ranges like this one can be matched quickly. Run the free in-browser dependency scan at https://gold.safeguard.sh/scan to see whether the affected package is in your lockfile or SBOM.
Why it matters
The record files this under CWE-191, integer underflow or wraparound. A length or size value is reduced below zero, wraps around to a huge number, and later code reads far more memory than it should. That produces the overread the record describes. In middleware that parses network messages, a length calculation mistake like this can be reachable by anyone who can send packets.
The CVSS vector rates it with network access, no privileges and no user interaction. Embedded and industrial systems are slow to update, which is why the mitigations in RTI's advisory matter. The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog.
Quick check
Which Connext Micro versions are affected?
From 4.0.0 before 4.3.0, according to the NVD record and RTI's advisory.
Is there a workaround?
RTI's advisory lists enabling the Lightweight Security plugin or protecting the network against unauthorized access.
Sources
Last reviewed: 19 October 2026.
