DEV Community

Anoymask
Anoymask

Posted on

EPICS Base 7.0.10 and Earlier: Four Pre-Authentication Memory Corruption and DoS Vulnerabilities

#security #threatintel

1. Basic Information

2. Quick Summary

Causal Security discovered four memory safety flaws in EPICS Base, which is used in research facilities and industrial control environments. They demonstrated that CVE-2026-114595 involves an integer overflow leading to a heap out-of-bounds write and a crash. All four vulnerabilities are addressed in EPICS Base 7.0.11, and no remote code execution (RCE) or active exploitation in the wild has been confirmed at the time of publication.

Environments where network services in research facilities or control systems are reachable without authentication face potential memory corruption or denial-of-service (DoS) risks, requiring careful attention due to the high impact if an attacker breaches internal boundaries.

3. Attack Flow

Memory Corruption and DoS via Crafted Network Messages

Attack Stage Attacker Action / Method Tools / Communications Defender Indicators (Conditions / Traces)
1. Connection Establishment and Channel Preparation Establishes a TCP connection to the EPICS service and creates a channel for Channel Access (CA) write paths TCP 5064 (Channel Access) / TCP 5075 (pvAccess) Vulnerable version 7.0.10 or earlier running with reachability to the port (no privileged account required in Causal verification)
2. Crafted Message Transmission Sends crafted protocol messages exploiting boundary check flaws or size calculation mismatches Crafted packets over CA / pvAccess protocols Connections from unusual clients or abnormal packet sizes and sequences
3. Triggering Vulnerable Processing Triggers integer overflows, type confusion, or boundary check defects Message processing inside the EPICS server process Memory safety violations via sanitizers or debuggers, or exception occurrences
4. Memory Corruption and Crash Causes heap out-of-bounds write/read or server thread/process crashes EPICS IOC / server process Process/thread crashes and core dump generation (RCE for CVE-2026-114595 and memory disclosure to remote clients for CVE-2026-114597/114598 are unverified)
  1. The attacker establishes a TCP connection to the EPICS service (default ports are TCP 5064 for Channel Access and TCP 5075 for pvAccess). Channel creation is also required for Channel Access write paths.
  2. Over the established connection, the attacker sends protocol messages with crafted size or type information.
  3. Server-side processing triggers an integer overflow, type confusion, or boundary check defect.
  4. As a result, heap out-of-bounds write/read or thread/process crashes (DoS) occur.
  5. While remote code execution (RCE) has been suggested for CVE-2026-114595, it has not been demonstrated.

4. Attacker Positioning and Execution Location

  • The attacker is located on an external or internal network with direct reachability to the network ports where EPICS services listen (such as TCP 5064/5075).

5. Victim and Administrator Perspective

Victims

  • May experience outages in research equipment or control services, or response anomalies on monitoring and operation terminals.

Administrators

  • May observe abnormal termination (crashes) of EPICS processes or threads, core dump outputs, and suspicious message traffic directed at TCP 5064/5075.

6. Success and Failure Conditions

CVSS scores for each vulnerability reported by CISA (ICSA-26-300-01) are as follows:

CVE CVSS v3.1 CVSS v4.0
CVE-2026-114595 9.8 9.3
CVE-2026-114596 8.2 8.8
CVE-2026-114597 7.5 8.7
CVE-2026-114598 7.5 8.7

Success Conditions

  • Requires vulnerable EPICS Base 7.0.10 or earlier to be running and the attacker to have TCP connectivity to the target protocol. Channel creation is also required for Channel Access write paths, though Causal's verification environment did not require a privileged account.

Failure Conditions and Mitigations

  • Updating to EPICS Base 7.0.11 or vendor-provided backported patched versions prevents these four vulnerabilities from succeeding.
  • Configuring zone-based access control lists (ACLs) and allowlists to block unnecessary network reachability to EPICS ports.

7. What Happens Upon Success

CISA explains that in addition to memory corruption and DoS, CVE-2026-114595 may lead to RCE, and CVE-2026-114597/114598 may expose adjacent memory contents. These represent impact evaluations and do not indicate successful demonstration of RCE or information disclosure to remote clients.

  • Unauthenticated denial of service (DoS) and memory corruption occur. Although RCE has been evaluated as a possibility for CVE-2026-114595, RCE was not demonstrated at the time of publication.

8. Observable Logs

Inference: The following are candidate logs to check within your organization. Availability depends on collection, retention, and product support, and should be distinguished from observation records in source materials.

  • Email: None applicable
  • Proxy / SWG / DNS: Check for unusual client connections to EPICS ports, short bursts of crafted message transmission, and connection resets (RST).
  • Endpoint / EDR: Check for EPICS process or thread crashes, core dump generation, and heap corruption detection events.
  • Identity / IdP: None applicable
  • SaaS / Cloud: None applicable
  • Network: Check for new source IP communications to TCP 5064/5075 or abnormal packet sizes and sequences.

9. Attack Success Determination

Confirmed in Public Research

Causal's isolated environment verification confirmed four memory corruption instances and process/thread crashes using sanitizers and debuggers. This demonstrates DoS and memory corruption, not arbitrary code execution (RCE) by an attacker. Furthermore, disclosure of memory contents to remote clients was not demonstrated for CVE-2026-114597.

Determination Criteria for Your Organization

  • Attack Attempt Observed (Success Unconfirmed) (contact_only): Criteria: Scanning or arrival of crafted packets at EPICS ports does not indicate successful DoS, memory corruption, or RCE.
  • Initial Execution Confirmed (initial_execution): Criteria: Classified as this stage only when attacker arbitrary code or command execution corresponding to the attack request is substantiated. Public research demonstrated memory corruption and crashes, but RCE remains unproven.

10. Investigation Playbook

  • Trigger: EPICS process crashes, observation of anomalous traffic on TCP 5064/5075, or detection of vulnerable versions.
  • Initial Checks: Verify running EPICS versions, vendor patch status, network ACLs, crash timestamps, and presence of core dumps.
  • Endpoint Investigation: Preserve and check process trees, core dumps, memory corruption traces, and suspicious file generation.
  • Identity and Cloud Investigation: Check service accounts and administrative login history on the affected host.
  • Follow-on Investigation: Investigate unauthorized changes to control parameters, lateral movement within the internal network, and data access.
  • Containment: Isolate affected services from the network, apply EPICS Base 7.0.11 or backported patches, and execute safe shutdown procedures as necessary.
  • Classification: Clearly separate and record "scan only", "DoS/crash", "memory corruption", "RCE achieved", and "control system impact".

11. Defense and Detection Ideas

  • Single Event: Detect EPICS process crashes accompanied immediately by unexpected client connections.
  • Time Series Correlation: Correlate connections to TCP 5064/5075, process exception occurrences, and service restarts in chronological order.
  • Hunting: Retroactively hunt for connections from new source IPs, abnormal packet sizes, and repeated transmission of identical payloads.
  • Logging Gaps: Standard asset management inventories may not record EPICS library versions embedded within control software.
  • Priority Controls: Prioritize patch application, network segmentation, source IP allowlisting, and monitoring for core dumps and service restarts.

12. Facts / Inference / Hypothesis

Facts

  • CVE-2026-114595 is an integer overflow leading to an attacker-influenced heap out-of-bounds write and a crash. CVSS v3.1 is 9.8 and v4.0 is 9.3; RCE is evaluated as a possibility but has not been demonstrated.
  • CVE-2026-114596 is a DoS via restricted out-of-bounds write, CVE-2026-114597 involves out-of-bounds read and crashes, and CVE-2026-114598 involves out-of-bounds read and server thread crashes due to type confusion.
  • The affected scope is EPICS Base 7.0.10 and earlier, fixed in EPICS Base 7.0.11.
  • Causal's autonomous system achieved initial discovery in 3 hours and 49 minutes, while deeper exploitability investigation involved a human providing a single prompt inside a sandbox.
  • CISA stated that it had received no reports of publicly known exploitation specifically targeting these vulnerabilities as of publication on October 27, 2026.

Inference

  • Inference: Even without direct exposure to the internet, checking internal reachability to TCP 5064/5075 is valuable because it can serve as a lateral movement path after a research network or control zone is breached.

Hypothesis

  • No additional hypotheses. Unconfirmed items are documented under "Uncertainties and Limitations".

13. MITRE ATT&CK Mapping

The source material does not provide sufficient evidence for a reliable ATT&CK mapping, so none is assigned.

14. Uncertainties and Limitations

  • A practical RCE chain for CVE-2026-114595 has not been published or demonstrated.
  • Application status of backports to custom packages provided by individual research facilities or vendors requires individual verification.
  • Whether CVE-2026-114597's out-of-bounds read discloses memory contents to remote clients has not been demonstrated.

15. Impact on SOCs and Organizations

Organizations operating EPICS at universities, synchrotron facilities, particle accelerators, and research equipment should transition to EPICS Base 7.0.11 or vendor-patched versions, while reviewing reachability between network zones on TCP 5064/5075.

16. Summary by Role

  • SOC: Evaluate scans, crashes, memory corruption, and arbitrary code execution in distinct stages, ensuring process crashes alone are not judged as successful RCE.
  • Administrators: Inventory EPICS versions, vendor builds, and network exposure ranges, and update to 7.0.11 or backported patched versions.
  • Users: Research facility users should report abnormal stoppages of equipment or control services to operations staff and avoid restarting services on their own initiative.

Top comments (0)