CVE-2026-114595 in EPICS Base
Summary
by MITRE • 10/27/2026
In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in EPICS Base versions 7.0.10 and earlier represents a critical security flaw rooted in improper integer arithmetic during the processing of network requests. This issue specifically manifests as an integer overflow, where the calculation for memory allocation size exceeds the maximum value that can be represented by the designated data type. When such an overflow occurs, the resulting allocated buffer is significantly smaller than what the application intends to handle or expects based on the input parameters. This discrepancy creates a dangerous state within the software's memory management subsystem, setting the stage for severe operational consequences when subsequent operations interact with this undersized buffer.
From a technical perspective, the core of this vulnerability lies in CWE-190, which classifies integer overflow or wraparound errors. In the context of EPICS Base, which serves as the foundational software framework for experimental physics and industrial control systems, handling network requests is a routine operation that often involves parsing variable-length data structures. If the logic responsible for determining buffer sizes fails to account for potential overflows before calling memory allocation functions like malloc or calloc, it may allocate a small block of memory while the application proceeds under the assumption that sufficient space exists. This mismatch between allocated and expected size is the precursor to CWE-120, Buffer Overflow without description of bounds check, which allows attacker-supplied data to write beyond the boundaries of the allocated heap region.
The operational impact of this flaw is substantial due to the nature of EPICS deployments in critical infrastructure environments such as particle accelerators, synchrotrons, and industrial automation facilities. The immediate consequence of memory corruption can be a denial of service, where the application crashes or becomes unresponsive, disrupting control processes that rely on continuous data availability. However, the risk extends far beyond simple disruption. An attacker who can craft malicious network packets to trigger this integer overflow may achieve remote code execution by carefully manipulating heap metadata and overwriting adjacent memory structures. This capability allows for arbitrary command execution with the privileges of the EPICS process, potentially granting unauthorized control over physical equipment or sensitive experimental data.
This vulnerability aligns with MITRE ATT&CK technique T1203, Exploitation for Defense Evasion, as well as techniques related to initial access and privilege escalation depending on the specific exploitation chain employed by an adversary. The ability to execute code remotely via network requests places this flaw in a high-severity category within threat modeling frameworks used by security operations centers monitoring industrial control systems. Attackers targeting these environments often seek persistent backdoors or immediate disruption capabilities, both of which are facilitated by successful exploitation of heap-based buffer overflows derived from integer errors.
Mitigation strategies must prioritize updating the EPICS Base software to version 7.0.11 or later, where this specific integer overflow has been addressed through improved input validation and safe arithmetic operations. In environments where immediate patching is not feasible due to operational constraints, network segmentation should be enforced to restrict access to EPICS control system interfaces from untrusted networks. Additionally, implementing strict firewall rules that limit the types of incoming requests can reduce the attack surface. Security monitoring tools should also be configured to detect anomalous memory usage patterns or unexpected process terminations associated with these services, providing an additional layer of defense against exploitation attempts while remediation efforts are underway.