EPICS Base: Integer overflow in network request processing

Summary

EPICS Base, the core toolkit for building control systems, contains an integer overflow in its network request processing (CVE-2026-114595). Memory can be allocated with an incorrect size, and later handling of attacker-supplied data may lead to memory corruption, denial of service or potentially remote code execution. The CNA CVSS 3.1 vector indicates network access without privileges or user interaction; CISA reports no known public exploitation at publication and no public RCE has been demonstrated.

Affected

• EPICS Base release 7.0.10 and earlier (0 to <= 7.0.10)

Fixed in

• EPICS Base 7.0.11
• Vendor patches: epics-base PR #934 and #937, pvDataCPP PR #109 (fixed version of pvDataCPP unknown)

Workaround

• No vendor workaround documented; the fix is the upgrade.
• Until patched, restrict access to Channel Access and pvAccess ports (default 5064 and 5075) from untrusted networks and isolate IOCs from the office network (general hardening, not vendor-confirmed).

Exploitation

• CISA reports no known public exploitation at publication.
• Discoverers demonstrated a heap out-of-bounds write and a crash; RCE has not been demonstrated.
• VulDB rates exploitation as easy; this is not evidence of observed attacks.

Our recommendation

• Ask whether any lab, accelerator, detector or building-automation system runs EPICS.
• If not, no action beyond normal patch hygiene is needed.
• If yes, upgrade EPICS Base to 7.0.11 and check pvDataCPP and other dependent components.
• Restrict Channel Access and pvAccess ports to trusted networks until patched.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  0xBlackash/CVE-2026-114595

Research sources

• CISA ICS Advisory ICSA-26-300-01 www.cisa.gov
• EPICS Base release R7.0.11 github.com
• DEV Community analysis dev.to
• OffSeq threat radar radar.offseq.com
• VulDB entry 427469 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:34.