Live › vulnerability › CVE-2026-114595
Go to dashboardEPICS Base release 7.0.10 and earlier has an integer overflow when it processes network requests, so memory is allocated with the wrong size. Attacker-supplied data handled afterward can corrupt memory, crash the service, or allow remote code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
Any host running EPICS Base 7.0.10 or earlier that accepts network traffic, typically control-system IOCs and gateways at physics and industrial facilities. Systems not exposed to untrusted networks face lower risk, but the sources do not say which network paths are reachable by default. Hosts on a fully isolated control network with no outside access can deprioritise it.
No product ranges from the sources yet.
softIoc -V or check the EPICS Base version in the build tree (unknown if the sources do not give the exact command)7.0.10 or earlier7.0.10 (the patched version number is unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-114595")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.