CVE-2026-114597
HighCVSS 7.5Summary
In EPICS Base 7.0.10 and earlier, insufficient validation of element or length values in a network message can cause an out-of-bounds read. This may lead to denial of service and expose adjacent memory contents.
Risk Assessment
An attacker could remotely cause application crashes or memory disclosure, potentially revealing sensitive information. The risk affects control systems using EPICS.
Recommendation
Update EPICS Base to a version containing the fix (later than 7.0.10) or apply a mitigation. Until patched, restrict network access to EPICS services.
Other vulnerabilities in EPICS Base
See all- CVE-2026-114598High
In EPICS Base 7.0.10 and earlier, insufficient validation of element or length values in a network message can cause an out-of-bounds read. This may lead to denial of service and expose adjacent memory contents.
- CVE-2026-114596High
In EPICS Base 7.0.10 and earlier, improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service.
- CVE-2026-114595Critical
In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker-supplied data may result in memory corruption, denial of service, or potential remote code execution.
Original NVD description (English source)
In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS