EPICS Base CVE-2026-114597

Exploitation requires the attacker to send a specially crafted network message to a reachable EPICS Base service (IOC/server) containing an element-count or length value that is not properly validated against the real buffer, triggering an out-of-bounds read. Per the supplied vector (PR:N/UI:N/AC:L/AT:N) no authentication, user interaction, or special attack conditions are indicated, and all EPICS Base releases 7.0.10 and prior are affected. The main practical limiting factor is network position: EPICS deployments typically sit on segmented control/OT networks for scientific or industrial facilities, so exploitation depends on the attacker reaching that network segment rather than on any non-default feature being enabled.

The vendor/ICS-CERT CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with no attack requirements, and rates only availability impact as High (VA:H) while confidentiality and integrity are N. This aligns with CWE-130 (improper handling of length/element values causing an out-of-bounds read) whose primary confirmed outcome is denial of service. There is a notable internal tension: the description states the OOB read 'could expose adjacent memory contents' (a confidentiality effect), yet the supplied vector sets VC:N, so the memory-disclosure potential is treated as unconfirmed/low-confidence by the scorer - this should be verified against the CISA advisory rather than assumed. On real-world signals the picture is mixed: the vuln.today decision label is 'this_week' (elevated but not emergency/act_now), it was reported by CISA ICS-CERT, and no EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the input. So this is a genuinely credible, remotely triggerable DoS in control-system software rather than a confirmed mass-exploited threat; the 8.7 score is driven mainly by the easy network attack path and high availability impact, and the absence of exploitation evidence suggests prioritized-but-not-drop-everything handling consistent with the 'this_week' label.

An attacker with network reachability to an EPICS IOC/server sends a crafted Channel Access/network message whose element-count or length field is inconsistent with the actual payload, causing the application to read past an allocated buffer. The process crashes (denial of service) and, per the description, may return adjacent memory contents. No public exploit or PoC reference is provided in the available data.