CVE-2026-114596
HighCVSS 8.2Summary
In EPICS Base 7.0.10 and earlier, improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service.
Risk Assessment
An attacker could remotely cause process crashes or instability, disrupting control systems. It may also potentially enable further attacks.
Recommendation
Update EPICS Base to a version containing the fix (later than 7.0.10) or apply a mitigation. Until patched, restrict network access to EPICS services.
Other vulnerabilities in EPICS Base
See all- CVE-2026-114598High
In EPICS Base 7.0.10 and earlier, insufficient validation of element or length values in a network message can cause an out-of-bounds read. This may lead to denial of service and expose adjacent memory contents.
- CVE-2026-114597High
In EPICS Base 7.0.10 and earlier, insufficient validation of element or length values in a network message can cause an out-of-bounds read. This may lead to denial of service and expose adjacent memory contents.
- CVE-2026-114595Critical
In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker-supplied data may result in memory corruption, denial of service, or potential remote code execution.
Original NVD description (English source)
In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS