Advisory · CVE-2026-114595
Integer overflow in EPICS Base network processing can corrupt memory and execute code
EPICS Base 7.0.10 and prior contain an integer overflow in network request processing that can allocate memory with an incorrect size, so subsequent handling of attacker-supplied data may corrupt memory, deny service, or potentially execute code remotely, with no privileges or interaction required. CVSS 3.1 9.8.
- Vendor
- The EPICS Community
- Product
- EPICS Base
- Identifier / CWE
- CVE-2026-114595
CWE-190 - Action timing
- Immediate
Explain it like I’m five
Control system software that sizes a memory box using an attacker's number can be tricked into building the box too small, then stuffing the full delivery in anyway. What spills over can rewrite the program's own instructions.
- 01Crafted network request sent
A remote unauthenticated attacker sends a request with a length value chosen to overflow the size calculation.
- 02Wrong size allocated
EPICS Base allocates memory with the incorrect, wrapped size.
- 03Data handled anyway
Subsequent handling of the attacker-supplied data writes beyond the allocation.
- 04Memory corrupts
Per CISA, the result can be memory corruption, denial of service, or potential remote code execution.
What happened
CISA published CVE-2026-114595 on October 27, 2026 in ICS advisory ICSA-26-300-01, rated critical at CVSS 3.1 9.8 (CVSS 4.0 9.3): in EPICS Base release 7.0.10 and prior, an integer overflow (CWE-190) in network request processing can cause memory to be allocated with an incorrect size, and subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution. The advisory header rates the EPICS Base issue set v3 9.8 and covers critical manufacturing deployments worldwide.
Per CISA, the EPICS Community has made updates available and affected users should update to the 7.0.11 release. CISA also recommends minimizing network exposure for control system devices, isolating control networks behind firewalls, and using updated VPNs where remote access is required.
What to do
- Inventory EPICS Base deployments across control system and laboratory networks and note versions, including copies embedded in vendor equipment.
- Update EPICS Base to 7.0.11 or later, following the EPICS Community guidance in ICSA-26-300-01, with change control appropriate to the process.
- Until updated, confirm EPICS services are not reachable from the internet or business networks, and restrict them to the control network segments that need them.
- Review network monitoring for malformed or oversized requests to EPICS services and for unexpected process crashes or restarts.
- Coordinate patching windows with operations, and verify the running version after the update.
Management note
EPICS sits underneath particle accelerators, telescopes, and manufacturing control, and it is often embedded where nobody inventories it. The patch needs an operations window, but the exposure reduction, keeping control protocols off reachable networks, does not have to wait for one.