CVE-2026-114598

Access of resource using incompatible type ('type confusion') in EPICS Base

At a glance

Severity: HIGH 8.7
State: PUBLISHED
Published: 2026-10-27
Updated: 2026-10-27
Assigner: icscert
NVD status: Received

Description

In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	icscert
CVSS 4.0	HIGH 8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	icscert
CVSS 4.0	HIGH 8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · ics-cert@hq.dhs.gov (Secondary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · ics-cert@hq.dhs.gov (Secondary)

Weaknesses (CWE)

CWE-843

European references

ENISA EUVD · EUVD-2026-111219
GCVE · GCVE-0-2026-114598

Affected products

Product	Versions
The EPICS Community · EPICS Base	affected 0 ≤ 7.0.10

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-01

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD