CVE-2026-114596

Integer overflow or wraparound in EPICS Base

En bref

Sévérité
HIGH 8.8
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
icscert
Statut NVD
Received

Description

In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service.

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Hicscert
CVSS 4.0HIGH 8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:Nicscert
CVSS 4.0HIGH 8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD · ics-cert@hq.dhs.gov (Secondary)
CVSS 3.1HIGH 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:HNVD · ics-cert@hq.dhs.gov (Secondary)

Faiblesses (CWE)

Références européennes

Produits affectés

ProduitVersions
The EPICS Community · EPICS Baseaffected 0 ≤ 7.0.10

Références

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD