EPICS Base 7.0.11 fixes four memory-safety bugs, including a critical 9.8 integer overflow that can lead to remote code execution
EPICS Base (Experimental Physics and Industrial Control System)
On October 27 CISA published ICS advisory ICSA-26-300-01 for EPICS Base, the open source control-system toolkit used to run particle accelerators, fusion experiments and other large research facilities. EPICS Base 7.0.10 and earlier have four bugs in network message handling: CVE-2026-114595 (CVSS 3.1 9.8, critical), an integer overflow in network request processing that allocates memory with the wrong size and can lead to memory corruption, denial of service or potential remote code execution; CVE-2026-114596 (8.2), an integer overflow from improper message length validation that causes an out-of-bounds write; CVE-2026-114597 (7.5), out-of-bounds reads from insufficient bounds checking; and CVE-2026-114598 (7.5), a type confusion that can cause denial of service and expose adjacent memory. Shubham Raj of Causal Security reported them, and The Register reports the company's autonomous AI agent Cipher found all four in under four hours. The EPICS community released EPICS Base 7.0.11 with the fixes; CISA's advisory does not mention exploitation. Update to 7.0.11 and keep EPICS networks isolated from untrusted access.
Why this severity: CVSS 3.1 9.8 (CVSS 4.0 9.3) for CVE-2026-114595, network-reachable without authentication; CISA's advisory does not mention exploitation
- Started
- Oct 27, 2026
Affected
- EPICS Base 7.0.10 and earlier
Fixed in
- EPICS Base 7.0.11
Timeline2
Advisories2
News & write-ups1
Get an email when a new major security incident drops. No spam, unsubscribe any time.
