CISA disclosed four vulnerabilities affecting EPICS Base 7.0.10 and earlier, with possible outcomes ranging from denial of service and information disclosure to memory corruption and potential remote code execution. Public exploitation is not known. The flaws are tracked as CVE-2026-114595 through CVE-2026-114598.
The vulnerabilities mishandle lengths in network messages: an overflow or incorrect size check can make EPICS allocate too little memory or write beyond a buffer. That can destabilize or stop the process; the most severe flaw could let a remote attacker execute code.
EPICS Base is a common layer in industrial control systems. If an affected instance supports operational services, a crash or compromise could affect the controls that depend on it. CISA identifies version 7.0.11 as the update, but the advisory does not establish how exposed deployments are or report public exploitation.
CVSS 9.8 CRITICAL: in EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size.
CVSS 8.2 HIGH: in EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write.
CVSS 7.5 HIGH: in EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer.
CVSS 7.5 HIGH: in EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer.
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code.