Critical Integer Overflow & Type‑Confusion Flaws in EPICS Base (CVE‑2026‑114595‑114598) Threaten Industrial Control Systems
What It Is — The EPICS Community disclosed four critical vulnerabilities in EPICS Base ≤ 7.0.10.
- CVE‑2026‑114595 – Integer overflow in network request processing can allocate memory of the wrong size, leading to memory corruption, denial‑of‑service, or remote code execution.
- CVE‑2026‑114596 – Improper handling of a length‑parameter inconsistency that may be abused to corrupt memory.
- CVE‑2026‑114597 – Type‑confusion when accessing a resource with an incompatible type, enabling arbitrary code execution.
- CVE‑2026‑114598 – Additional integer‑wraparound issue with similar impact.
All four receive a CVSS v3.1 base score of 9.8 (Critical). EPICS Base is a core software library for the Experimental Physics and Industrial Control System (EPICS) used worldwide in critical manufacturing and other industrial control environments. Exploitation could allow an attacker to disrupt plant operations, exfiltrate sensitive process data, or take control of supervisory‑level functions.
Affected Products — EPICS Community · EPICS Base releases ≤ 7.0.10 (global deployments in critical manufacturing).
Why It Matters for Trust & Control Assurance — The flaws test the vulnerability‑management control objective: organizations must maintain an up‑to‑date inventory, monitor for critical flaws, and apply patches promptly to preserve the integrity of control‑system environments.
Recommended Actions —
- Upgrade every EPICS Base installation to version 7.0.11 or later from the official GitHub repository.
- Verify the version across all assets and record remediation in your vulnerability‑management system.
- Incorporate EPICS Base version checks into continuous configuration monitoring to generate defensible audit evidence.
Source: CISA Advisory – ICSA‑26‑300‑01