CVE-2026-114595 Integer overflow or wraparound in EPICS Base

CriticalCVSS 9.3 EPSS 0.50%

Published: 2026-10-27 18:48
Updated: 2026-11-04 23:17
Exploit status: No public exploit known

Description

In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution.

Affected products

Product	Affected versions	Fixed in
The EPICS Community EPICS Base	<= 7.0.10	No fix listed
ubuntu/epics-base(Ubuntu:22.04)	All versions	No fix listed
ubuntu/epics-base(Ubuntu:24.04)	All versions	No fix listed
ubuntu/epics-base(Ubuntu:26.04)	All versions	No fix listed
ubuntu/epics-base(Ubuntu:26.10)	All versions	No fix listed

References

www.cisa.gov government-resource
Ubuntu CVE tracker vendor-advisory
www.cve.org

CVSS v4.0

9.3 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (5)

v4.0 9.3 · icscert
v4.0 9.3 · ics-cert@hq.dhs.gov
v3.1 9.8 · icscert
v3.1 9.8 · ubuntu
v3.1 9.8 · ics-cert@hq.dhs.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.50% (percentile 43.5)
CWE: CWE-190 Integer overflow or wraparound

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.