---
id: CVE-2026-114595
title: Integer overflow or wraparound in EPICS Base
summary: >-
  In EPICS Base release 7.0.10 and prior, an integer overflow in network request
  processing can cause memory to be allocated with an incorrect size. Subsequent
  handling of attacker supplied data may result in memory corruption, denial of
  s…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-190
vendor: The EPICS Community
product: EPICS Base
affected:
  - epics_base <= 7.0.10
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T16:48:37.138Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114595'
references:
  - url: 'https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-01'
tags:
  - cve.org
ingestedAt: '2026-10-27T17:33:23.792Z'
---

## Overview

In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution.

## Affected

- `epics_base <= 7.0.10`

## Remediation

The EPICS Community has made available updates to the epics-base GitHub repositories. Affected users should update to the 7.0.11 release. For more information, users should contact the EPICS Controls team https://epics-controls.org/support/.



https://github.com/epics-base/epics-base/pull/934
https://github.com/epics-base/epics-base/pull/937
https://github.com/epics-base/pvDataCPP/pull/109