{"id":"CVE-2026-114598","kind":"vulnerability","aliases":["CVE-2026-114598"],"related":[],"title":"EPICS Base: network message length check lets reads overrun buffers","description":"In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.","summary":"EPICS Base release 7.0.10 and earlier does not validate element or length values in a network message, so a crafted message can make the application read past an allocated buffer. An attacker can crash the service (denial of service) and may read adjacent memory contents.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["epics","industrial-control","infrastructure","scada","self-hosted"],"not_affected_if":["isolated-network","no-network-exposure"],"how_to_check":"- Check the installed EPICS Base version against `7.0.10` (e.g. `grep -r \"EPICS_VERSION\" <epics-base>/configure/CONFIG_BASE_VERSION` or the `base` directory name)\n- Note whether IOCs or gateways built on EPICS Base listen on the network (CA/PVA ports)","fix":"- Move EPICS Base to a release newer than `7.0.10` (fixed version unknown from sources; check the EPICS Base release notes)\n- Rebuild IOCs and gateways against the patched Base and restart them\n- Restrict CA/PVA network access to trusted hosts until patched (unknown from sources, general mitigation)","status":"open","published_at":"2026-10-27T17:16:59+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","triaged_at":"2026-10-27T17:34:24+00:00","updated_at":"2026-10-27T17:34:24+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-27T17:34:24Z","model":"claude-haiku-5-5","output":{"fix":"- Move EPICS Base to a release newer than `7.0.10` (fixed version unknown from sources; check the EPICS Base release notes)\n- Rebuild IOCs and gateways against the patched Base and restart them\n- Restrict CA/PVA network access to trusted hosts until patched (unknown from sources, general mitigation)","reach":"network","title":"EPICS Base: network message length check lets reads overrun buffers","impact":"medium","summary":"EPICS Base release 7.0.10 and earlier does not validate element or length values in a network message, so a crafted message can make the application read past an allocated buffer. An attacker can crash the service (denial of service) and may read adjacent memory contents.","category":"infrastructure","nicknames":[],"who_cares":["epics","scada","industrial-control","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Service crashes and adjacent memory contents can be read remotely","analyst_note":"Confirm the fixed EPICS Base version and which network protocol/message triggers the overread, via the NVD entry and EPICS Base advisories.","how_to_check":"- Check the installed EPICS Base version against `7.0.10` (e.g. `grep -r \"EPICS_VERSION\" <epics-base>/configure/CONFIG_BASE_VERSION` or the `base` directory name)\n- Note whether IOCs or gateways built on EPICS Base listen on the network (CA/PVA ports)","needs_analyst":true,"not_affected_if":["no-network-exposure","isolated-network"],"who_is_affected":"Any site running EPICS Base 7.0.10 or earlier with an IOC, gateway or client exposed to the network, since the flaw is in parsing network messages. Systems with no network exposure to EPICS channel access traffic are less exposed. The sources do not say which message types or ports trigger it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000673,"input_tokens":3295,"output_tokens":686,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114598':13A,16A '-2026':12A,15A '7.0.10':29B,75C 'adjac':68B,113C 'alloc':54B,101C 'applic':50B,93C 'attack':57B 'base':2A,27B,73C 'beyond':96C 'bound':98C 'buffer':10A,55B,102C 'caus':91C 'check':6A 'content':70B,115C 'control':20B 'could':111C 'craft':45B 'crash':59B 'cve':11A,14A 'denial':62B,107C 'earlier':31B 'element':35B,82C 'epic':1A,17B,26B,72C 'expos':112C 'host':25B 'industri':19B 'industrial-control':18B 'infrastructur':21B 'insuffici':79C 'lead':105C 'length':5A,37B,84C 'let':7A 'make':48B 'may':66B,104C 'memori':69B,114C 'messag':4A,42B,46B,89C 'network':3A,41B,88C 'overrun':9A 'past':52B 'prior':77C 'read':8A,51B,67B,95C 'releas':28B,74C 'scada':22B 'self':24B 'self-host':23B 'servic':61B,64B,109C 'valid':34B,80C 'valu':38B,85C","nicknames":[],"mitigations":[],"who_affected":"Any site running EPICS Base 7.0.10 or earlier with an IOC, gateway or client exposed to the network, since the flaw is in parsing network messages. Systems with no network exposure to EPICS channel access traffic are less exposed. The sources do not say which message types or ports trigger it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114598","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114598","severity":null,"published_at":"2026-10-27T17:16:59+00:00","modified_at":"2026-10-27T17:16:59+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","fetched_at":"2026-10-27T17:32:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}