Description
In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The EPICS Community | EPICS Base | ≤ 7.0.10 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | epics-base | No fix yet | — |
| Ubuntu 26.04 LTS | epics-base | No fix yet | — |
| Ubuntu 24.04 LTS | epics-base | No fix yet | — |
| Ubuntu 22.04 LTS | epics-base | No fix yet | — |
Advisories 1
- ICSA-26-300-01 EPICS Base CISA ICS & IT advisories · Oct 27, 2026
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-01 government-resource