EPICS Base EUVD-2026-111109

The affected component must be processing the EPICS network protocol and reachable by the attacker; exploitation requires sending a crafted message whose length value is mishandled during protocol parsing (CWE-190 integer overflow). Per the supplied CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N), no authentication, no user interaction, and no special attack requirement are indicated, implying default-configuration reachability over the network. The main limiting factor is network exposure: EPICS deployments are typically on segmented control-system/facility networks, so real-world reach depends on whether the vulnerable process is accessible to the attacker. The available sources do not name the exact message type or field that triggers the overflow, so the precise trigger is not described in the available sources.

Signals are mixed and lean toward a serious-but-not-emergency availability issue. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, and the base score of 8.8 is driven almost entirely by availability (VA:H) with only limited integrity impact (VI:L) and no confidentiality impact (VC:N) - consistent with the description's stated outcome of process instability or denial of service rather than code execution or data theft. The vuln.today Decision label is 'this_week' (not act_now/emergency), and the vulnerability was reported through ICS-CERT with a CISA ICS advisory published, indicating a vetted, coordinated disclosure. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no evidence of active exploitation or a working exploit. The primary caveat: the CWE-190 integer overflow is described as producing an out-of-bounds write, which is a memory-corruption primitive that could in principle exceed pure DoS, but the available sources only claim instability/DoS - do not treat memory-write as confirmed code execution. Overall this is a credible priority for operators of the affected control-system software, warranting prompt patching within the week, but not a drop-everything emergency on the strength of the supplied signals.

An attacker with network access to an EPICS Base endpoint sends a crafted protocol message carrying a manipulated length field; improper validation causes an integer overflow during parsing that leads to an out-of-bounds memory write. The affected process becomes unstable or crashes, denying service to the control-system application. No public exploit code was identified in the input, so this scenario is inferred from the description and CVSS vector rather than a demonstrated PoC.