Four EPICS Base Flaws Patched, Including One That Could Enable Code Execution
Summary
CISA disclosed four unauthenticated network-triggerable flaws in EPICS Base 7.0.10 and earlier, including one that could potentially enable remote code execution. EPICS 7.0.11 patches the issues; no public exploitation has been reported.
Key points
- The flaws affect EPICS Base 7.0.10 and earlier; CISA recommends upgrading to version 7.0.11.
- All four vulnerabilities involve Channel Access or pvAccess network communication and can be triggered without authentication or user interaction by an attacker with network access.
- CVE-2026-114595 is an integer overflow that can corrupt memory and cause denial of service; remote code execution is possible but has not been achieved.
- The other flaws can cause process instability, denial of service, an out-of-bounds memory read, or potential leakage of nearby memory.
- Cipher demonstrated an attacker-controlled heap write and process crash using AddressSanitizer, but did not pursue a functional remote-code-execution exploit.
- CISA has received no reports of public exploitation. The number of internet-facing EPICS deployments is unknown.
Article Details
- Vulnerability Types
- Integer overflow
- Out-of-bounds write
- Out-of-bounds read
- Type confusion
- Severity
- CVSS 9.8 for CVE-2026-114595, 8.2 for CVE-2026-114596, and 7.5 each for CVE-2026-114597 and CVE-2026-114598
- Affected Versions
- EPICS Base 7.0.10 and earlier
- Exploitation Status
- not_reported
- Exploit Availability
- claimed_or_private
- Patch Status
- available
MITRE ATT&CK
T1210 · Exploitation of Remote ServicesThe flaws can be triggered without authentication by sending attacker-supplied network data to vulnerable EPICS services using Channel Access or pvAccess.T1499.004 · Application or System ExploitationMalformed network data exploiting the flaws can crash or destabilize EPICS processes, causing denial of service.
CVE
CVE-2026-114595The most severe of the bugs is CVE-2026-114595 (CVSS score of 9.8), an integer overflow that can occur when network requests are processed.CVE-2026-114596Exploiting CVE-2026-114596 (CVSS score of 8.2) can cause an out-of-bounds write that leaves the process unstable or causes DoS. CVE-2026-114597 (CVSS score of 7.5) is an out-of-bounds read that could crash theCVE-2026-114597(CVSS score of 8.2) can cause an out-of-bounds write that leaves the process unstable or causes DoS. CVE-2026-114597 (CVSS score of 7.5) is an out-of-bounds read that could crash the application and leak data fromCVE-2026-114598is an out-of-bounds read that could crash the application and leak data from nearby memory, while CVE-2026-114598 (CVSS score of 7.5) is a type confusion issue that can be triggered with malformed network data,
People
Products
EPICSFour vulnerabilities in EPICS Base could allow attackers to crash processes in control systems used at particle accelerators, fusion experiments and other large research facilities.EPICS BaseFour vulnerabilities in EPICS Base could allow attackers to crash processes in control systems used at particle accelerators, fusion experiments and other large research facilities.