EPICS Base: 4 CVEs, Critical 9.8
Summary
CISA reports 4 vulnerabilities in The EPICS Community EPICS Base release. Weakness types: Integer Overflow or Wraparound, Improper Handling of Length Parameter Inconsistency, Access of Resource Using Incompatible Type ('Type Confusion'). Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code. Highest CVSS v3 score: 9.8 (Critical), exploitable over the network.
At a glance
- Vendor
- The EPICS Community
- Products
- EPICS Base release
- CVEs
- CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598
- Highest CVSS v3
- 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing
- Deployed
- Worldwide
- Vendor HQ
- Global
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-114595 | Integer Overflow or Wraparound | 9.8 | – | No | In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution. |
| CVE-2026-114596 | Integer Overflow or Wraparound | 8.2 | – | No | In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service. |
| CVE-2026-114597 | Improper Handling of Length Parameter Inconsistency | 7.5 | – | No | In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents. |
| CVE-2026-114598 | Access of Resource Using Incompatible Type ('Type Confusion') | 7.5 | – | No | In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents. |
Affected products (1)
- The EPICS Community EPICS Base release: <=7.0.10
Vendor fixes and mitigations (from advisory)
- Mitigation: The EPICS Community has made available updates to the epics-base GitHub repositories. Affected users should update to the 7.0.11 release. For more information, users should contact the EPICS Controls team https://epics-controls.org/support/. link
- Mitigation: https://github.com/epics-base/epics-base/pull/934 link
- Mitigation: https://github.com/epics-base/epics-base/pull/937 link
- Mitigation: https://github.com/epics-base/pvDataCPP/pull/109 link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.