All CISA Advisories, EN

EPICS Base

View CSAF

Summary

Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code.

The following versions of EPICS Base are affected:

  • EPICS Base release <=7.0.10 (CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598)

CVSS
Vendor
Equipment

v3 9.8
The EPICS Community
EPICS Base release

3 Vulnerabilities

Integer Overflow or Wraparound, Improper Handling of Length Parameter Inconsistency, Access of Resource Using Incompatible Type ('Type Confusion')

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Global

Vulnerabilities
Expand All +

CVE-2026-114595
In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution.
Read More

1 Affected Product

The EPICS Community EPICS Base release: <=7.0.10

Product Status: known_affected

Remediations

Mitigation
The EPICS Community has made available updates to the epics-base GitHub repositories. Affected users should update to the 7.0.11 release. For more information, users should contact the EPICS Controls team https://epics-controls.org/support/.

Mitigation
https://github.com/epics-base/epics-base/pull/934

Mitigation
https://github.com/epics-base/epics-base/pull/937

Mitigation
https://github.com/epics-base/pvDataCPP/pull/109

Additional Metrics

Relevant CWE: CWE-190 Integer Overflow or Wraparound

CVSS Version
Base Score
Base Severity
Vector String

3.1
9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0
9.3
CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

View CVE Details

CVE-2026-114596
In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service.
Read More

2 Affected Products

The EPICS Community EPICS Base release: <=7.0.10

Product Status: known_affected

Remediations

Mitigation
The EPICS Community has made available updates to the epics-base GitHub repositories. Affected users should update to the 7.0.11 release. For more information, users should contact the EPICS Controls team https://epics-controls.org/support/.

Mitigation
https://github.com/epics-base/epics-base/pull/934

Mitigation
https://github.com/epics-base/epics-base/pull/937

Mitigation
https://github.com/epics-base/pvDataCPP/pull/109

The EPICS Community EPICS Base release: <=7.0.10

Product Status: known_affected

Remediations

Mitigation
The EPICS Community has made available updates to the epics-base GitHub repositories. Affected users should update to the 7.0.11 release. For more information, users should contact the EPICS Controls team https://epics-controls.org/support/.

Mitigation
https://github.com/epics-base/epics-base/pull/934

Mitigation
https://github.com/epics-base/epics-base/pull/937

Mitigation
https://github.com/epics-base/pvDataCPP/pull/109

Additional Metrics

Relevant CWE: CWE-190 Integer Overflow or Wraparound

CVSS Version
Base Score
Base Severity
Vector String

3.1
8.2
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

4.0
8.8
HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

View CVE Details

CVE-2026-114597
In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.
Read More

3 Affected Products

The EPICS Community EPICS Base release: <=7.0.10

Product Status: known_affected

Remediations

Mitigation
The EPICS Community has made available updates to the epics-base GitHub repositories. Affected users should update to the 7.0.11 release. For more information, users should contact the EPICS Controls team https://epics-controls.org/support/.

Mitigation
https://github.com/epics-base/epics-base/pull/934

Mitigation
https://github.com/epics-base/epics-base/pull/937

Mitigation
https://github.com/epics-base/pvDataCPP/pull/109

The EPICS Community EPICS Base release: <=7.0.10

Product Status: known_affected

Remediations

Mitigation
The EPICS Community has made available updates to the epics-base GitHub repositories. Affected users should update to the 7.0.11 release. For more information, users should contact the EPICS Controls team https://epics-controls.org/support/.

Mitigation
https://github.com/epics-base/epics-base/pull/934

Mitigation
https://github.com/epics-base/epics-base/pull/937

Mitigation
https://github.com/epics

[…]
Content was trimmed to protect the source. Please visit the original article for the full text.

This article has been indexed from All CISA Advisories

Read the original article:

EPICS Base