External risk intelligence

EPICS Base Integer Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-114595

EPICS (Experimental Physics and Industrial Control System) is typically used for specialized control systems in scientific and research facilities. These networks are generally air-gapped or isolated behind strict perimeter controls and are not intended to be exposed to the public internet.

Integer Overflow

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves an integer overflow in network request processing within EPICS Base, potentially leading to memory corruption, service disruption, or unauthorized code execution. The primary concern is to confirm if this technology is used within the organization and assess any exposure.

Integer overflow allows memory corruption.
Critical systems could be impacted.
Assess if EPICS Base is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network requests to an exposed EPICS Base service. This could lead to memory corruption, causing a denial of service or potentially allowing the attacker to execute their own code on the system.

No authentication or special access needed.
Vulnerable network request processing.
Denial of service or code execution.

Live Threat

Current exploitation, exposure, and threat context

An integer overflow in network request processing could lead to memory corruption, a denial of service, or potentially remote code execution, when attacker-supplied data is handled improperly.

System memory could be corrupted.
Malformed network requests could trigger the overflow.
System instability or unauthorized code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Technical leaders must identify where EPICS Base is deployed and confirm its exposure and criticality before planning remediation. This involves understanding if the affected system is reachable from the internet or other less trusted networks, identifying the system's accountable owner, and assessing the business impact of potential exploitation. The first practical step is to locate all instances of EPICS Base, determine their connectivity, and assess their criticality to operations to prioritize remediation efforts.

Own by EPICS system administrators.
Verify network exposure and criticality.
Plan remediation during maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is EPICS Base?

EPICS (Experimental Physics and Industrial Control System) Base is the foundational software library used to build distributed control systems. It is widely employed in scientific and research environments—such as particle accelerators and telescopes—to monitor and manage specialized hardware equipment in real time.

What does an integer overflow mean for CVE-2026-114595?

This vulnerability, classified as CWE-190, occurs when a calculation exceeds the storage capacity of a memory container. In this context, it causes the software to allocate an incorrect, typically insufficient, amount of memory for incoming network data. This flaw leads to memory corruption, which can crash the service or enable an attacker to run unauthorized commands.

How can an attacker trigger this vulnerability?

An attacker triggers the bug by sending a specially crafted network request to the EPICS Base service. The vulnerability exists within the software's network request processing logic. Importantly, successful exploitation does not require the attacker to have pre-existing credentials or special user access; the system accepts and processes the malicious data automatically.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal notes that EPICS is typically used in specialized, research-oriented environments that are often air-gapped or shielded by strict perimeter controls. If your instances are truly isolated from the public internet, the practical risk is significantly lower than for services that are directly exposed to external, untrusted networks.

How should I respond to this vulnerability?

The first step is to perform an inventory to locate all instances of EPICS Base within your infrastructure. Once identified, verify whether these systems are reachable from the internet or other less trusted network segments. Prioritize remediation for any systems found to be exposed, and coordinate with your system administrators to plan updates during scheduled maintenance windows.

References

www.cisa.gov/news-events/ics-advisories/icsa-26-300-01

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.