CVE-2026-114595: Integer overflow or wraparound in EPICS Base
In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
epics-baseto a version that resolves this vulnerability.Fixed in 7.0.11
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
EPICS Base release 7.0.10 and prior are affected. The vulnerable code is in network request processing, so systems that accept network requests to EPICS Base are exposed.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What impact should defenders plan for?
Processing attacker-supplied data after the incorrect allocation can cause memory corruption and denial of service, with potential remote code execution. The vulnerability is rated critical with high impact to confidentiality, integrity, and availability.