Loading vulnerability…
Out-of-bounds read in EPICS Base network message processing
CVE-2026-114597 is an out-of-bounds read vulnerability in EPICS Base 7.0.10 and earlier. Insufficient validation of element or length values in network messages can cause an application to read beyond an allocated buffer. A remote, unauthenticated attacker can trigger the flaw through malformed network messages, potentially crashing the affected process or exposing adjacent memory contents.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can crash an affected EPICS application, causing denial of service. In control-system deployments, this could interrupt monitoring, measurements, or control functions and disrupt experiments. Adjacent memory contents could also be exposed, although the published CVSS vectors assign high availability impact and no confidentiality or integrity impact. Remote code execution is not established for this vulnerability.
If you can’t patch tonight, do this now.
Minimize network exposure of EPICS services and prevent direct internet access. Place control-system networks and remote devices behind firewalls, isolate them from business networks, and restrict access to trusted systems. Where remote access is necessary, use securely configured, updated VPNs. Assess operational risks before implementing defensive changes.
Patch, then assume compromise.
Upgrade affected EPICS Base installations to version 7.0.11, which includes a fix for this vulnerability. Perform operational impact analysis and testing before deploying the update to production control systems.
No public exploits tracked yet. Mallory keeps watching.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.