CVE-2026-114598: Access of resource using incompatible type ('type confusion') in EPICS Base
In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
epics-baseto a version that resolves this vulnerability.Fixed in 7.0.11
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability is reachable over the network and requires neither privileges nor user interaction, according to the supplied CVSS vector.
Which deployments should be considered affected?
EPICS Base versions 7.0.10 and earlier are affected. Deployments running those releases should be reviewed, particularly where EPICS network message handling is exposed to untrusted or broadly reachable network clients.
What is the expected impact if exploitation succeeds?
A crafted network message can cause an out-of-bounds read, resulting in denial of service and potentially exposing adjacent memory contents. The supplied severity vector indicates availability impact is high, while confidentiality and integrity impacts are rated none.