EPICS Base 7.0.10 and earlier: network flaws up to CVSS 9.8
Original title: EPICS Base
Update to EPICS Base 7.0.11; the worst flaw can corrupt memory and may allow remote code execution.
CISA's ICS advisory covers four flaws in EPICS Base release 7.0.10 and earlier from the EPICS Community. An integer overflow in network request processing can mis-size memory and lead to corruption, denial of service, or potential remote code execution, scored CVSS 9.8. Related length-validation bugs can cause out-of-bounds writes or reads, process instability, and possible disclosure of adjacent memory. Users should update to the 7.0.11 release.
Unconfirmed: Exploitation is not addressed, and the supplied text truncates the CVE-2026-114598 description.
- CVE-2026-114595 is CVSS 3.1 9.8 and CVSS 4.0 9.3.
- CVE-2026-114596 is CVSS 3.1 8.2; CVE-2026-114597 is 7.5.
- All four affect EPICS Base release <=7.0.10; the fix is 7.0.11.
- Critical Manufacturing is named; deployment is described as worldwide.
- The provided text cuts off during CVE-2026-114598.
Impact: Denial of service, memory corruption, data disclosure, or potential code execution
| Product | Affected | Fixed in |
|---|---|---|
| The EPICS Community EPICS Base | <=7.0.10 | 7.0.11 |
- 1.Update affected EPICS Base installations to the 7.0.11 release.
- 2.Contact the EPICS Controls team for support details.
- Vendors
- The EPICS Community
- Products
- EPICS Base
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114595 | Integer overflow in EPICS Base network request processing | 9.3 | <1% | PoC ×2 | |
CVE-2026-114596+2 related CVEs | Integer overflow in EPICS Base protocol parsing through 7.0.10 | 8.8 group max | — |
From the original article
5 min read at cisa.govView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code. The following versions of EPICS Base are affected: EPICS Base release <=7. 0.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.