CVE-2026-114595

Integer overflow or wraparound in EPICS Base

En bref

Sévérité
CRITICAL 9.3
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
icscert
Statut NVD
Received

Description

In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution.

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1CRITICAL 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hicscert
CVSS 4.0CRITICAL 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nicscert
CVSS 4.0CRITICAL 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD · ics-cert@hq.dhs.gov (Secondary)
CVSS 3.1CRITICAL 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD · ics-cert@hq.dhs.gov (Secondary)

Faiblesses (CWE)

Références européennes

Produits affectés

ProduitVersions
The EPICS Community · EPICS Baseaffected 0 ≤ 7.0.10

Références

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD