Loading vulnerability…
Integer overflow in EPICS Base network request processing
CVE-2026-114595 is an integer overflow vulnerability in network request processing in EPICS Base 7.0.10 and earlier. Attacker-controlled network data can trigger an incorrectly sized memory allocation, after which subsequent processing can produce an attacker-controlled out-of-bounds heap write. Successful exploitation can cause memory corruption, denial of service, or potentially remote code execution. Exploitation requires no authentication or user interaction. A heap write and process crash were demonstrated, but remote code execution was not demonstrated.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can corrupt memory and crash affected EPICS processes, disrupting monitoring and control functions. In scientific control-system deployments, such disruption could interrupt measurements, halt experiments, and cause downtime or loss of experimental work. Potential remote code execution could compromise the confidentiality, integrity, and availability of the affected process and enable interference with its control functions; these outcomes beyond the demonstrated memory corruption and crash remain unconfirmed.
If you can’t patch tonight, do this now.
Minimize exposure of EPICS control-system services and prevent direct internet accessibility. Place control-system networks and remote devices behind firewalls and isolate them from business networks. Use secure, maintained remote-access mechanisms such as updated VPNs when remote access is necessary. Conduct operational impact analysis and risk assessment before deploying defensive changes.
Patch, then assume compromise.
Upgrade affected installations from EPICS Base 7.0.10 or earlier to EPICS Base 7.0.11, which includes fixes for this vulnerability.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.