{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/the-epics-community/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-114595"},{"id":"CVE-2026-114596"},{"id":"CVE-2026-114597"},{"id":"CVE-2026-114598"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["EPICS Base (\u003c=7.0.10)"],"_cs_severities":["critical"],"_cs_tags":["critical-infrastructure","memory-corruption","integer-overflow","rce","dos"],"_cs_type":"advisory","_cs_vendors":["The EPICS Community"],"content_html":"\u003cp\u003eMultiple vulnerabilities exist in EPICS Base release 7.0.10 and prior, primarily involving integer overflows and improper handling of length parameters during network message parsing. These flaws can lead to out-of-bounds memory access, corruption, and remote code execution (RCE). The EPICS Community has released version 7.0.11 to address these issues.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of these vulnerabilities allows for process instability, denial-of-service, sensitive information disclosure from process memory, and potential execution of arbitrary code with the privileges of the EPICS Base process.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all EPICS Base installations to release 7.0.11 immediately.\u003c/li\u003e\n\u003cli\u003eReview the upstream GitHub repository pull requests (PR #934, PR #937, and pvDataCPP PR #109) for technical implementation details of the fixes.\u003c/li\u003e\n\u003cli\u003eRestrict access to EPICS network ports to trusted management subnets to minimize the attack surface until patching is complete.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T16:40:03Z","date_published":"2026-10-27T16:40:03Z","id":"https://feed.craftedsignal.io/briefs/2026-10-epics-base-vulnerabilities/","summary":"EPICS Base versions 7.0.10 and earlier contain multiple critical vulnerabilities in network request processing that could allow unauthenticated remote attackers to cause denial-of-service, disclose memory contents, or execute arbitrary code.","title":"EPICS Base: Remote code execution and denial of service (CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598)","url":"https://feed.craftedsignal.io/briefs/2026-10-epics-base-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - The EPICS Community","version":"https://jsonfeed.org/version/1.1"}