Description
In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service.
Published: 2026-10-27
Score: 8.8 High
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

The EPICS Community has made available updates to the epics-base GitHub repositories. Affected users should update to the 7.0.11 release. For more information, users should contact the EPICS Controls team https://epics-controls.org/support/. https://github.com/epics-base/epics-base/pull/934 https://github.com/epics-base/epics-base/pull/937 https://github.com/epics-base/pvDataCPP/pull/109

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service.
Title Integer overflow or wraparound in EPICS Base
Weaknesses CWE-190
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2026-10-27T16:50:09.514Z

Reserved: 2026-10-21T20:17:33.386Z

Link: CVE-2026-114596

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T17:16:58.690

Modified: 2026-10-27T17:16:58.690

Link: CVE-2026-114596

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses