EUVD-2026-111219
GHSA-f386-8q3g-8c7r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed EPICS network service
-
ExploitSend message with invalid element/length field
-
ExecutionTrigger out-of-bounds buffer read
-
ImpactCrash service or leak adjacent memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network access - a remote, unauthenticated attacker (PR:N/UI:N) who can send a crafted message to an EPICS Base network service (Channel Access or PV Access protocol) can trigger the flaw against default builds of versions 7.0.10 and prior. The core limiting factor is network exposure: EPICS Base is control-system middleware typically deployed on segmented or air-gapped facility/control networks, so realistic reachability depends on whether the affected service port is accessible to the attacker. Impact is primarily service crash (DoS); any memory exposure is described as a possibility, not a guaranteed outcome. |
| Impact | This is a genuine but context-bounded priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated trigger with no user interaction, and the published base score of 8.7 is driven almost entirely by VA:H (availability impact from denial of service). Exploitation status is 'no public exploit identified at time of analysis' - this CVE is not in CISA KEV, no EPSS probability was supplied in the input, and no PoC/exploit reference is present, so there is no evidence of active or automated exploitation. The vuln.today decision label is 'this_week', which signals prompt (near-term) remediation rather than emergency action, consistent with the absence of KEV/PoC signals. One notable conflict: the official CVSS 4.0 vector records VC:N (no confidentiality impact), yet the description explicitly states the out-of-bounds read 'could expose adjacent memory contents' - the severity vector and the narrative disagree on confidentiality, so the information-disclosure dimension should be verified rather than treated as settled. EPSS is missing from the input and cannot be used to gauge exploitation likelihood; its absence is a data gap, not a low score. |
| Exploit ScenarioDerived | An attacker with network reachability to an exposed EPICS Base service sends a crafted Channel Access / PV Access network message containing an invalid element count or length value. The server fails to validate the field and reads past the end of an allocated buffer, crashing the process (denial of service) and potentially returning adjacent heap memory to the attacker. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Out-of-bounds read in EPICS Base 7.0.10 and earlier lets a remote, unauthenticated attacker who can deliver a crafted message to an EPICS network service (Channel Access or PV Access) make the process read past the end of an allocated buffer, primarily crashing the service and potentially exposing adjacent memory. Affected deployments are typically control-system middleware on segmented or air-gapped facility networks, so real-world reachability depends on whether the protocol port is exposed to the attacker; default builds of all versions up to and including 7.0.10 are in scope. No public exploit was identified at time of analysis, and the vendor/coordinator advisory is ICSA-26-300-01; priority is this_week rather than emergency response.
RemediationAI
No vendor-released patch or fixed version was identified in the available data, so remediation must begin with consulting CISA advisory ICSA-26-300-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-01) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-114598) for the vendor's current fix guidance and to confirm when a corrected EPICS Base release supersedes 7.0.10. Because the authoritative assessment ties exploitability to network reachability of the Channel Access or PV Access service, the actionable compensating control is to restrict which hosts and subnets can reach those EPICS protocol ports on IOCs and gateways - enforced through control-network segmentation, firewall rules, or host access lists - accepting the trade-off that remote CA/PVA clients outside the permitted set will lose connectivity and that any legitimate cross-zone client must be re-homed or proxied. Operators who cannot immediately constrain reachability should treat exposed IOCs as at risk of repeated service crashes, monitor for unexpected IOC restarts or abnormal termination, and plan a maintenance-window restart capability; since the same parsed message path is involved, restarting alone does not remove exposure. Note that no public exploit was identified at time of analysis, and the absence of a published exploit should not be read as confirmation that exploitation is impractical on reachable services.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
EPICS Base is the core library and network protocol implementation underpinning EPICS control systems (Channel Access and PV Access), widely used in scientific and industrial facilities. The flaw is classified CWE-843 (type confusion): the message parser performs insufficient validation of element or length values carried in a network message, so a supplied value is used to bound a buffer access without being checked against the actual allocation size, producing an out-of-bounds read. Per the description this can lead to denial of service and could expose adjacent memory contents, though the authoritative assessment treats memory exposure as a possibility rather than a guaranteed outcome and scores confidentiality impact Low against High availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H). The CVSS 4.0 vector similarly carries AV:N/AC:L/AT:N/PR:N/UI:N with high availability impact, confirming that no authentication or user interaction is required and that the trigger is a crafted network message to an exposed service - the sources do not describe further environmental prerequisites beyond network reachability. CPE data identifies the affected package generically as the_epics_community:epics_base without a version bound, while the coordinator and ENISA EUVD data bound it at 7.0.10 and prior.
Know when Epics Base gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated network message with no user interaction (AV:N/AC:L/PR:N/UI:N); A:H for the DoS, C:L for possible adjacent-memory disclosure per the description, I:N as no integrity impact.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.
Executive ViewAI
A high-severity memory-safety flaw in EPICS Base (7.0.10 and earlier) exposes facility control-system middleware to remote, unauthenticated attackers who can send a crafted message over Channel Access or PV Access, most likely crashing the service and potentially leaking adjacent memory. The blast radius is operational rather than data-centric: availability of the control system that underpins facility operations is at risk wherever these protocol ports are reachable. Leadership should care because a crash of this middleware can disrupt monitoring and control functions in segmented or air-gapped environments, and leadership should prioritize based on actual network reachability rather than severity alone.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict Channel Access and PV Access protocol ports to trusted hosts via segmentation and firewall rules, minimize network reachability to only required control-system peers, monitor service processes for unexpected crashes, and isolate exposed deployments on dedicated segments until an upstream fix is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Epics Base
View allRemote memory corruption and denial of service in EPICS Base 7.0.10 and prior can be triggered by a remote, unauthentica
High-severity integer overflow in EPICS Base 7.0.10 and earlier can be reached over the network without authentication o
Out-of-bounds read in EPICS Base 7.0.10 and prior allows unauthenticated remote attackers to crash or degrade an affecte
Exploit-DB