CVE-2026-114595
Integer overflow or wraparound in EPICS Base
- State
- Published
- Severity
- 9.3 Critical
- Published
- Oct 27, 2026
- Updated
- Oct 27, 2026
- Reserved
- Oct 21, 2026
Description
In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | icscert |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | icscert |
Weaknesses
- CWE-190 Integer overflow or wraparound
Affected Products
| Product | Versions |
|---|---|
EPICS BaseThe EPICS Community |
|
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-01government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.