Four Critical Vulnerabilities Discovered in EPICS Base Software

The Cybersecurity and Infrastructure Security Agency (CISA) has published advisory ICSA-26-300-01, revealing four security vulnerabilities in EPICS Base, an open-source software suite widely used in industrial control systems and critical manufacturing environments. The affected versions are EPICS Base release 7.0.10 and prior.

The vulnerabilities are:
- CVE-2026-114595: An integer overflow in network request processing that can cause memory to be allocated with an incorrect size, potentially leading to memory corruption, denial of service, or remote code execution.
- CVE-2026-114596: Improper validation of message length values during protocol parsing that can trigger an integer overflow, resulting in an out-of-bounds memory write and process instability or denial of service.
- CVE-2026-114597: Insufficient validation of element or length values in a network message that may allow the application to read beyond the bounds of an allocated buffer, leading to denial of service and potential exposure of adjacent memory contents.
- CVE-2026-114598: [Details pending - advisory source text truncated]

CVSS scores range from 8.2 (HIGH) to 9.8 (CRITICAL). The relevant CWE is CWE-190 (Integer Overflow or Wraparound). All four flaws affect the EPICS Base release 7.0.10 and earlier and are assigned known_affected status.

The EPICS Community has released updates to the epics-base GitHub repositories, including pull requests #934, #937, and #109 (pvDataCPP). Affected users are advised to update to the 7.0.11 release immediately. For support, users should contact the EPICS Controls team.

The software is deployed worldwide, with particular presence in critical manufacturing and other critical infrastructure sectors. No confirmed active exploitation in the wild is reported at the time of the advisory, though the nature of the flaws could allow remote attackers to compromise systems via network-facing services.