CISA warns of critical memory corruption vulnerabilities in EPICS Base

The Cybersecurity and Infrastructure Security Agency released an advisory on October 27, 2026, warning of critical vulnerabilities in EPICS Base software. CISA Alerts reported that successful exploitation of the flaws allows an attacker to cause a denial of service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code. [1]

According to CISA Alerts, an integer overflow issue exists in the network request processing of EPICS Base release 7.0.10 and prior versions. The vulnerability causes memory to be allocated with an incorrect size, which can result in memory corruption or remote code execution when handling attacker-supplied data. [1]

EPICS, short for Experimental Physics and Industrial Control System, is a set of open-source software tools used to build distributed control systems and provide SCADA capabilities. The framework operates large scientific facilities including telescopes and particle accelerators. [2]

CISA Alerts reported that the EPICS Community has released updates to the epics-base GitHub repositories to resolve the issues. Security teams and affected users are advised to update their deployments to version 7.0.11. [1]