EPICS Base: Out-of-bounds read via insufficient length validation
Summary
EPICS Base release 7.0.10 and earlier does not sufficiently validate element or length values in network messages. A remote attacker can cause the application to read beyond the bounds of an allocated buffer, which may lead to a denial of service. Adjacent memory contents could also be exposed, but this is not verified. Exposure is highest where EPICS services are reachable from untrusted networks.
Affected
- EPICS Base release 7.0.10 and earlier (<=7.0.10)
Fixed in
- EPICS Base 7.0.11 (according to the EPICS Community, updates are available in the epics-base repositories)
Workaround
- Restrict network access to EPICS ports (Channel Access and pvAccess, TCP 5064 and 5075) with firewall rules and allowlists.
- Keep EPICS systems separated from business networks and the internet.
Exploitation
- CISA reports no known public exploitation of this vulnerability at publication.
- No public proof of concept was found for this CVE.
- Not listed in the CISA KEV catalog at the time of research.
Our recommendation
- Check whether EPICS Base or software built on it runs in your environment, including vendor-supplied OT appliances, and record the versions.
- If affected, plan the upgrade to 7.0.11 and review the release notes before rollout, coordinating with the operational owners.
- Until patched, confirm that EPICS ports are not reachable from the internet or business networks.
- Monitor the NVD and CISA entries for updates to the CWE and CVSS score.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICS Advisory ICSA-26-300-01 www.cisa.gov
- Strix CVE record CVE-2026-114597 www.strix.ai
- VulDB entry 427472 vuldb.com
- OffSeq radar entry CVE-2026-114597 radar.offseq.com
- Write-up on EPICS Base 7.0.10 vulnerabilities dev.to
- Assurant Cyber blog on ICSA-26-300-01 www.assurantcyber.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:55.
Original description (NVD)
In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.