EUVD-2026-111108
GHSA-q8f9-5g2r-f3jg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed EPICS network service
-
DeliverySend crafted oversized request
-
ExploitTrigger integer overflow in allocation
-
ExecutionCorrupt memory with attacker data
-
ImpactCrash service or execute code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to a listening EPICS Base service that processes the affected network request path (EPICS networking, e.g. Channel Access / PVAccess); the CVSS vector (AV:N/PR:N/UI:N/AC:L) indicates no authentication, no user interaction, and low complexity against affected versions 7.0.10 and prior. The input does not name a specific configuration toggle, so no non-default setting is confirmed as a prerequisite. The primary practical LIMIT is exposure: EPICS is typically deployed on isolated or segmented control/experiment networks, so an attacker must already have a route to the service; the strongest outcome (RCE) is described by the vendor as 'potential' rather than confirmed, while memory corruption and DoS are the more certain impacts. |
| Impact | Multiple signals converge on genuine priority, though one key dynamic signal is absent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H, score 9.3 Critical) describes a remotely reachable, low-complexity flaw needing no privileges, attack requirements, or user interaction, with high impact to confidentiality, integrity and availability - the maximal-exposure profile for a network service. The vuln.today Decision label is 'act_now', and the issue was reported by ICS-CERT with a dedicated CISA ICS advisory, which raises its credibility and operational urgency. Countervailing context: this is CWE-190 integer overflow that the vendor describes only as 'potential remote code execution' alongside the more certain memory corruption and DoS outcomes, so full RCE is characterized as possible rather than demonstrated. EPSS score is NOT provided in the input, there is no CISA KEV entry, and no PoC or exploit reference is supplied, so there is no public evidence of active exploitation or working exploit code at this time. The practical risk is therefore driven by the combination of a critical, unauthenticated network vector in control-system software and the 'act_now' decision, tempered by the fact that EPICS deployments typically sit on segmented control networks rather than the open internet, which constrains real-world reachability. |
| Exploit ScenarioDerived | An attacker with network access to an exposed EPICS Base service (e.g. Channel Access / PVAccess endpoints) sends a crafted network request whose length/size field triggers the integer overflow, causing an undersized buffer allocation. Subsequent processing of the attacker-supplied data writes beyond the allocation, producing memory corruption that can crash the service (denial of service) or potentially be leveraged toward remote code execution. No public exploit identified at time of analysis; the precise trigger beyond 'network request processing' is not detailed in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Remote memory corruption and denial of service in EPICS Base 7.0.10 and prior can be triggered by a remote, unauthenticated integer overflow in network request processing, which causes an undersized allocation before attacker-supplied data is handled; remote code execution is described by the vendor as potential rather than confirmed. Exploitation requires network reachability to a listening EPICS Base service on the affected request path, and EPICS is often deployed on segmented control or experiment networks, which limits exposure but does not protect reachable services. No public exploit was identified at time of analysis, and the vuln.today decision label is act_now.
RemediationAI
The provided data does not list a fixed EPICS Base release version, so no exact vendor patch version can be cited and no vendor-released patch with an exact fixed version is identified in the provided data; consult the CISA ICS advisory icsa-26-300-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-01) for current vendor update guidance and apply the fixed release once identified. No specific configuration toggle is confirmed as a workaround in the available data. Because the confirmed prerequisite is network reachability to a listening EPICS Base service that processes the affected network request path, restrict access to EPICS Channel Access/PVAccess endpoints to trusted control-network hosts and segments; this reduces exposure but does not fix the integer overflow and does not protect against an attacker who already has a route, such as a compromised control host. Treat the issue as act_now priority and verify reachable EPICS Base versions against the advisory.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
EPICS Base is the core software of the Experimental Physics and Industrial Control System, providing the networking layer used by control-system clients and servers, including Channel Access and PVAccess as referenced in the independent assessment. The flaw is CWE-190 integer overflow: an arithmetic size calculation in network request processing can wrap and cause memory to be allocated with an incorrect, too-small size; later handling of attacker-supplied data can then corrupt memory, crash the service, or potentially achieve code execution. The available sources do not identify the exact request field, protocol message, or code path that triggers the overflow, and the vendor's strongest impact statement is 'potential' remote code execution, so memory corruption and denial of service are the more certain outcomes.
Know when Epics Base gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network request processing with no user interaction gives AV:N/AC:L/PR:N/UI:N; memory corruption with potential RCE and DoS supports C/I/A:H and scope unchanged.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution.
Executive ViewAI
A critical vulnerability in EPICS Base 7.0.10 and prior exposes organizations relying on EPICS for scientific or industrial control systems to remote, unauthenticated attacks that can cause memory corruption and denial of service, with potential for remote code execution. Because EPICS often underpins segmented control or experiment networks, reachable services could be disrupted, impacting operations and safety. Leadership should prioritize verification of network exposure and urgent mitigation, as no patch is available.
Restrict network access to EPICS services using firewalls and segmentation; monitor for malicious traffic; apply vendor-recommended mitigations when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Epics Base
View allHigh-severity integer overflow in EPICS Base 7.0.10 and earlier can be reached over the network without authentication o
Out-of-bounds read in EPICS Base 7.0.10 and earlier lets a remote, unauthenticated attacker who can deliver a crafted me
Out-of-bounds read in EPICS Base 7.0.10 and prior allows unauthenticated remote attackers to crash or degrade an affecte
Exploit-DB