{"id":"CVE-2026-114595","kind":"vulnerability","aliases":["CVE-2026-114595"],"related":[],"title":"EPICS Base: integer overflow in network requests corrupts memory, enables code execution","description":"In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution.","summary":"EPICS Base release 7.0.10 and earlier has an integer overflow when it processes network requests, so memory is allocated with the wrong size. Attacker-supplied data handled afterward can corrupt memory, crash the service, or allow remote code execution.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["epics","industrial-control","infrastructure","ioc","scientific-control-systems"],"not_affected_if":["isolated-network","newer-epics-base"],"how_to_check":"- Run `softIoc -V` or check the EPICS Base version in the build tree (unknown if the sources do not give the exact command)\n- Confirm whether the installed EPICS Base is `7.0.10` or earlier","fix":"- Move EPICS Base to a release newer than `7.0.10` (the patched version number is unknown from the sources)\n- Restrict network access to IOC ports (CA 5064, PVA 5075) until patched","status":"open","published_at":"2026-10-27T17:16:58+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","triaged_at":"2026-10-27T17:34:15+00:00","updated_at":"2026-10-27T17:34:15+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-27T17:34:15Z","model":"claude-haiku-5-5","output":{"fix":"- Move EPICS Base to a release newer than `7.0.10` (the patched version number is unknown from the sources)\n- Restrict network access to IOC ports (CA 5064, PVA 5075) until patched","reach":"network","title":"EPICS Base: integer overflow in network requests corrupts memory, enables code execution","impact":"high","summary":"EPICS Base release 7.0.10 and earlier has an integer overflow when it processes network requests, so memory is allocated with the wrong size. Attacker-supplied data handled afterward can corrupt memory, crash the service, or allow remote code execution.","category":"infrastructure","nicknames":[],"who_cares":["epics","ioc","scientific-control-systems","industrial-control"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs code on the IOC host remotely","analyst_note":"Find the patched EPICS Base release and the affected protocol/handler from the NVD entry or the EPICS advisory; confirm the default network exposure.","how_to_check":"- Run `softIoc -V` or check the EPICS Base version in the build tree (unknown if the sources do not give the exact command)\n- Confirm whether the installed EPICS Base is `7.0.10` or earlier","needs_analyst":true,"not_affected_if":["isolated-network","newer-epics-base"],"who_is_affected":"Any host running EPICS Base 7.0.10 or earlier that accepts network traffic, typically control-system IOCs and gateways at physics and industrial facilities. Systems not exposed to untrusted networks face lower risk, but the sources do not say which network paths are reachable by default. Hosts on a fully isolated control network with no outside access can deprioritise it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000647,"input_tokens":3304,"output_tokens":633,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-114595':15A,18A '-2026':14A,17A '7.0.10':32B,73C 'afterward':57B 'alloc':47B,88C 'allow':65B 'attack':53B,96C 'attacker-suppli':52B 'base':2A,30B,71C 'caus':84C 'code':11A,67B,110C 'control':22B,27B 'corrupt':8A,59B,103C 'crash':61B 'cve':13A,16A 'data':55B,98C 'denial':104C 'earlier':34B 'enabl':10A 'epic':1A,19B,29B,70C 'execut':12A,68B,111C 'handl':56B,94C 'incorrect':91C 'industri':21B 'industrial-control':20B 'infrastructur':23B 'integ':3A,37B,77C 'ioc':24B 'may':99C 'memori':9A,45B,60B,85C,102C 'network':6A,42B,80C 'overflow':4A,38B,78C 'potenti':108C 'prior':75C 'process':41B,82C 'releas':31B,72C 'remot':66B,109C 'request':7A,43B,81C 'result':100C 'scientif':26B 'scientific-control-system':25B 'servic':63B,106C 'size':51B,92C 'subsequ':93C 'suppli':54B,97C 'system':28B 'wrong':50B","nicknames":[],"mitigations":[],"who_affected":"Any host running EPICS Base 7.0.10 or earlier that accepts network traffic, typically control-system IOCs and gateways at physics and industrial facilities. Systems not exposed to untrusted networks face lower risk, but the sources do not say which network paths are reachable by default. Hosts on a fully isolated control network with no outside access can deprioritise it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114595","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114595","severity":null,"published_at":"2026-10-27T17:16:58+00:00","modified_at":"2026-10-27T17:16:58+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","fetched_at":"2026-10-27T17:32:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}