Loading vulnerability…
Type Confusion and Out-of-Bounds Read in EPICS Base
CVE-2026-114598 is a type confusion vulnerability affecting EPICS Base 7.0.10 and earlier. Insufficient validation of element or length values in malformed network messages can cause an application to read beyond an allocated buffer. An unauthenticated attacker with network access to a vulnerable EPICS service can trigger denial of service and potentially expose adjacent memory contents. Exploitation requires no user interaction.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can crash an affected EPICS process, disrupting control or monitoring functions. In scientific and industrial deployments, this could interrupt experiments, measurements, or equipment operations and cause downtime. Adjacent process memory may also be disclosed, although the published CVSS assessments assign no confidentiality impact. Remote code execution is not an established impact of this vulnerability.
If you can’t patch tonight, do this now.
Minimize network exposure of EPICS services and prevent direct internet access. Isolate control-system networks from business networks using firewalls, and restrict access to authorized systems. Where remote access is necessary, use maintained, updated VPN solutions. Perform operational impact analysis and risk assessment before deploying defensive changes.
Patch, then assume compromise.
Upgrade affected installations from EPICS Base 7.0.10 or earlier to EPICS Base 7.0.11, which includes the fix.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.