EPICS Base: Integer overflow leading to out-of-bounds memory write
Summary
EPICS Base release 7.0.10 and earlier fails to validate message length values during protocol parsing. An attacker who can reach the EPICS network services can trigger an integer overflow and write memory out of bounds. This can crash the affected process or cause a denial of service, and the NVD analysis is still pending.
Affected
- EPICS Base release 7.0.10 and prior (<= 7.0.10)
- Downstream or distribution builds and bundled copies in vendor control software must be checked individually; no vendor backport list was found.
Fixed in
- Update to EPICS Base release 7.0.11 (vendor recommendation).
- Backported versions: Unknown.
Workaround
- No workaround is documented by the vendor or CISA.
- Interim measure: restrict reachability of TCP 5064 and 5075 from non-control networks. This reduces exposure but does not fix the flaw.
Exploitation
- CISA reports no public exploitation of this flaw as of the advisory date.
- No public exploit code or PoC for CVE-2026-114596 was found; status is unknown.
Our recommendation
- Inventory all EPICS Base installations, including bundled copies in vendor software.
- Test and then upgrade to EPICS Base 7.0.11 or a verified vendor backport. Note that 7.0.11 stricter message validation may affect some old Channel Access clients.
- Restrict network access to EPICS ports from non-control networks until patched.
- Monitor affected hosts for crashes or unexpected restarts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICS Advisory ICSA-26-300-01 www.cisa.gov
- PSIRT CVE-2026-114596 psirt.com
- VulDB 427475 vuldb.com
- OffSeq Threat Radar CVE-2026-114596 radar.offseq.com
- Mayhem Code: EPICS Base 7.0.11 fixes four security issues www.mayhemcode.com
- Crypto Briefing: AI agent finds EPICS vulnerabilities cryptobriefing.com
- The Register: AI hacker finds four bugs in industrial control software www.theregister.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:12.
Original description (NVD)
In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.