CVE-2026-114597: Improper handling of length parameter inconsistency in EPICS Base

Q: What level of access does an attacker need to exploit this issue?

The CVSS vector indicates network-based exploitation with no required privileges or user interaction. An attacker would need network access to the affected EPICS Base instance.

Q: Which versions should be treated as affected?

EPICS Base 7.0.10 and earlier are affected according to the available information. Deployments running these releases should be assessed, particularly where the service is reachable over the network.

Published Oct 27, 2026

Updated

In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.

Affected Software

1 affected component

EPICS EPICS Base<=7.0.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade EPICS Base to a version that resolves this vulnerability.
Fixed in 7.0.11

Event History

Oct 27, 2026

CVE Published

via MITRE·04:51 PM

Data Sourced

via MITRE·04:51 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The CVSS vector indicates network-based exploitation with no required privileges or user interaction. An attacker would need network access to the affected EPICS Base instance.

Which versions should be treated as affected?