Skip to content

Back to the catalog

cisa.govadvisory

EPICS Base

CISA ICS advisory ICSA-26-300-01 (October 27, 2026) covers EPICS Base release 7.0.10 and earlier, with CVE-2026-114595 through CVE-2026-114598. Flaws include integer overflow, length parameter inconsistency and type confusion, allowing denial of service, memory corruption, information disclosure or remote code execution (CVSS v3.1 9.8). The fix is EPICS Base 7.0.11, with patches in epics-base and pvDataCPP pull requests.

TL;DR CISA advisory on critical remote memory-corruption flaws in EPICS Base 7.0.10 and earlier, fixed in 7.0.11.
Open original ↗

CVEs named here

  • CVE-2026-114595
  • CVE-2026-114596
  • CVE-2026-114597
  • CVE-2026-114598

Technologies named here

  • CVSS v4.0
  • CSAF
  • CVSS
  • CISA
  • CVSS v3.1
  • CWE-190
  • EPICS Base
  • The EPICS Community EPICS Base release <=7.0.10 (CISA advisory ICSA-26-300-01, released October 27, 2026; Critical Manufacturing sector, deployed worldwide)

Techniques named here

  • Integer Overflow or Wraparound
  • Integer Overflow
  • Type confusion
  • Access of Resource Using Incompatible Type ('Type Confusion')
  • Improper Handling of Length Parameter Inconsistency

Related in AppSec