Vulnerability · Published Oct 27, 2026 · Assigned by icscert
CVE-2026-114596Integer overflow or wraparound in EPICS Base
High 8.2
In plain English
A high-severity integer overflow in EPICS Base from The EPICS Community. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.3%top 82.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | epics-base | no fix listed | UBUNTU-CVE-2026-114596 |
| Ubuntu:24.04:LTS | epics-base | no fix listed | UBUNTU-CVE-2026-114596 |
| Ubuntu:26.04:LTS | epics-base | no fix listed | UBUNTU-CVE-2026-114596 |
| Ubuntu:26.10 | epics-base | no fix listed | UBUNTU-CVE-2026-114596 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The EPICS Community | EPICS Base | 0 – through 7.0.10 |
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-01 government-resource