This vulnerability enables an attacker to read memory beyond the boundary of a buffer within RTI Connext Micro’s core libraries. Because the offending read accesses data stored adjacent to the intended buffer, sensitive information that resides in that memory area may be exposed. The weakness is classified as CWE‑125, a classic out‑of‑bounds read flaw that results in unintended information disclosure.

The affected product is RTI Connext Micro. All releases from 4.0.0 up to, but not including, 4.3.0 contain the vulnerable code. Deployments that have not applied the patch or upgraded to a newer release are potentially impacted.

The CVSS score of 8.8 signals high severity, but the EPSS score of less than 1% indicates a low likelihood of exploitation in the immediate future. Because it is not listed in CISA’s KEV catalog, no widespread exploitation has been observed. The available data does not detail specific attack conditions; the likely attack vector, inferred from the vulnerability’s nature, would involve the application possessing local or embedded access that can trigger the overread, while remote exploitation requires additional context that is not specified.