Description
In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution.
Published: 2026-10-27
Score: 9.3 Critical
EPSS: n/a
KEV: No
Impact: Remote code execution and denial of service
Action: Immediate Patch
AI Analysis

Impact

EPICS Base releases before 7.0.11 contain an integer overflow in network request processing. The flaw lets an attacker send crafted data that causes memory allocation with an incorrect size, leading to memory corruption that can result in denial of service or remote code execution, depending on how the corrupted memory is subsequently handled.

Affected Systems

The EPICS Community's EPICS Base product is affected. All installations running EPICS Base version 7.0.10 and earlier are vulnerable. The fix is available in release 7.0.11; users are advised to upgrade to that version or later.

Risk and Exploitability

The CVSS base score of 9.3 indicates critical severity. No EPSS score is available, so the likelihood of exploitation is not quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. However, the attack vector is network-based and does not require authentication, making it exploitable by any remote party that can send a crafted request to the EPICS Base process.

Generated by OpenCVE AI on October 27, 2026 at 18:43 UTC.

Remediation

Vendor Solution

The EPICS Community has made available updates to the epics-base GitHub repositories. Affected users should update to the 7.0.11 release. For more information, users should contact the EPICS Controls team https://epics-controls.org/support/. https://github.com/epics-base/epics-base/pull/934 https://github.com/epics-base/epics-base/pull/937 https://github.com/epics-base/pvDataCPP/pull/109

OpenCVE Recommended Actions

  • Update EPICS Base to version 7.0.11 or later.
  • Restrict network connections to trusted clients and reject overly large requests.
  • Block untrusted inbound traffic and monitor logs for anomalous request patterns.

Generated by OpenCVE AI on October 27, 2026 at 18:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution.
Title Integer overflow or wraparound in EPICS Base
Weaknesses CWE-190
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2026-10-27T16:48:37.138Z

Reserved: 2026-10-21T20:17:32.733Z

Link: CVE-2026-114595

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T17:16:58.530

Modified: 2026-10-27T17:16:58.530

Link: CVE-2026-114595

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T18:45:07Z

Weaknesses
  • CWE-190

    Integer Overflow or Wraparound