CVE-2026-114595
CriticalCVSS 9.8Summary
In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker-supplied data may result in memory corruption, denial of service, or potential remote code execution.
Risk Assessment
An attacker could send a crafted network request, causing a service crash or potentially taking control of the system. The risk affects environments using EPICS Base for device control and monitoring.
Recommendation
Update EPICS Base to a version later than 7.0.10 that includes the fix. Restrict network access to EPICS services to trusted networks only.
Other vulnerabilities in EPICS Base
See all- CVE-2026-114598High
In EPICS Base 7.0.10 and earlier, insufficient validation of element or length values in a network message can cause an out-of-bounds read. This may lead to denial of service and expose adjacent memory contents.
- CVE-2026-114597High
In EPICS Base 7.0.10 and earlier, insufficient validation of element or length values in a network message can cause an out-of-bounds read. This may lead to denial of service and expose adjacent memory contents.
- CVE-2026-114596High
In EPICS Base 7.0.10 and earlier, improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service.
Original NVD description (English source)
In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS