Integer overflow in EPICS Base request processing corrupts memory
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-190 and the CVSS impact.
Summary
EPICS Base release 7.0.10 and prior are affected. An integer overflow (CWE-190) in network request processing causes memory to be allocated with an incorrect size. A remote, unauthenticated attacker can supply data that leads to memory corruption, denial of service, or potentially remote code execution.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| The EPICS Community | EPICS Base | up to 7.0.10 | — | No fix listed | CNA |
- EPICS Base VendorThe EPICS Community Affected up to 7.0.10 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for EPICS Base.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Timeline
- 2026-10-27 Threatist record created from CVE-2026-114595
- 2026-10-27 Alias added: GHSA-q8f9-5g2r-f3jg
- 2026-11-04 CISA SSVC decision points changed
References
More The EPICS Community vulnerabilities
- TI-2026-81436 Integer overflow in EPICS Base leads to out-of-bounds memory write CVSS 4.0HIGH 8.8
- TI-2026-81438 Out-of-bounds read in EPICS Base network message handling CVSS 4.0HIGH 8.7
- TI-2026-81437 Out-of-bounds read in EPICS Base network message handling CVSS 4.0HIGH 8.7
Sources
- CVE-2026-114595 · CVE Program
- CVE-2026-114595 · NVD
- FIRST EPSS
- GHSA-q8f9-5g2r-f3jg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences