The software that connects a scientific instrument to its operators is easy to overlook. A particle accelerator may have sophisticated protection systems, but routine monitoring and control still depend on network services parsing messages from other machines. The correctness of those parsers is part of the facility’s security boundary.
EPICS (Experimental Physics and Industrial Control System) is a widely used open-source framework for building these systems. Its components are used in particle accelerators, synchrotron light sources, major telescopes, and fusion experiments. EPICS is also a foundational component of ITER’s CODAC control-system architecture.
Cipher, our autonomous security system, found four memory-safety vulnerabilities in EPICS Base in 3 hours and 49 minutes. Three affect the server-side parsing and handling of Channel Access (CA) messages. The fourth affects deserialization in the classic pvAccess (PVA) implementation. The findings include integer overflows leading to out-of-bounds writes, an out-of-bounds read, and a type confusion during connection validation.
CISA published the findings on 27 October 2026 in ICSA-26-300-01. The EPICS maintainers shipped fixes in EPICS Base 7.0.11. The most severe vulnerability, CVE-2026-114595 (CVSS 9.8), produced an attacker-influenced heap-buffer-overflow write in Cipher’s sandbox. Remote code execution is a potential consequence of this class of corruption, but Cipher did not demonstrate it.
Cipher did the work end to end, starting from a codebase it had not seen before. The investigation required no human intervention; the one human step was a single instruction authorizing deeper exploitability testing in an isolated sandbox.
For EPICS operators: Review deployments running EPICS Base 7.0.10 or earlier and downstream distributions that embed vulnerable components. Update to 7.0.11 or obtain vendor-backported fixes. Restrict access to IOC network services, particularly from untrusted and broadly reachable network segments. By default, Channel Access requests use TCP 5064 and pvAccess TCP 5075; UDP 5064 and 5076 carry discovery.
What makes these bugs reachable?
An EPICS Input/Output Controller (IOC) exposes process variables and control functions to client software. Channel Access and pvAccess are two of the protocols through which clients find those services and communicate with them. In most deployments, IOCs are meant to sit behind a segmented control-network boundary.
EPICS supports IOC access-security rules for Channel Access and pvAccess, and the pvAccess connection-validation protocol provides authentication mechanisms. Those controls govern what a client may read or write; they do not make a malformed message safe to parse. The pvAccess issue is reached during connection validation, before that exchange completes.
The Channel Access findings sit in server-side message handling and need a normal TCP connection, plus a channel for the write paths. In Cipher’s test configuration, no privileged account was required. Neither access-security rules nor network segmentation substitutes for the fixes.
Findings at a glance
| CVE | Protocol and defect | Demonstrated effect | Published severity |
|---|---|---|---|
| CVE-2026-114595 | Channel Access: integer overflow in sizing a write request | Heap-buffer-overflow write and process crash | Critical, 9.8 |
| CVE-2026-114596 | Channel Access: extended-header length overflow | Constrained out-of-bounds write and process crash | High, 8.2 |
| CVE-2026-114597 | Channel Access: unchecked element count | Out-of-bounds read and process crash | High, 7.5 |
| CVE-2026-114598 | pvAccess: type confusion in deserialization | Out-of-bounds read and server-thread crash | High, 7.5 |
1. An element count overflows an allocation calculation (CVE-2026-114595)
Impact: A crafted Channel Access write request can cause the server to allocate too little memory for the data it subsequently processes. CISA rates the issue Critical, with a CVSS score of 9.8.
A Channel Access request carries a data type and an element count. The vulnerable handling path checks the type but does not adequately bound the count before combining it with the element size. That calculation can overflow 32-bit arithmetic, yielding a smaller allocation than the subsequent conversion requires. The parser has validated one part of the message while still trusting the field that drives the memory requirement.
Under AddressSanitizer, Cipher’s request triggered a heap-buffer-overflow write of attacker-influenced bytes past the undersized allocation, followed by a crash. The corruption carries a potential for remote code execution; Cipher did not build an RCE exploit or evaluate reliability on production builds.
The fix in epics-base PR #934 adds cross-checks between the reported element count, the channel, the data type, and the received payload size before unsafe operations proceed.
2. An extended-header length wraps a size check (CVE-2026-114596)
Impact: A malformed Channel Access extended-header length causes the server’s message-size calculation to wrap, allowing an oversized value to evade a check. Later handling uses the original value as an offset, resulting in a constrained out-of-bounds write and a remotely induced crash. CISA rates the issue High, CVSS 8.2.
The extended header supplies a 32-bit payload length. The server combines it with fixed header overhead using 32-bit arithmetic. A value near that integer width’s upper bound can make the calculated total wrap around to a small number. That small result can pass checks designed to reject messages that are too large. A later channel-creation path then uses the original payload length to place a terminating byte beyond the available memory.
Under a debugger, the process faulted on the out-of-bounds write. Because the write is a fixed byte at an offset constrained by the calculation, the outcome is a denial of service with a limited write primitive, not a general arbitrary-write capability. PR #934 rejects the oversized extended length before it can wrap.
3. A write count exceeds the received payload (CVE-2026-114597)
Impact: A Channel Access write request can claim more elements than its payload contains. The server proceeds to convert data beyond the received buffer, producing an out-of-bounds read and process crash. CISA rates the issue High, CVSS 7.5.
On this path, the server converts elements in the receive buffer based on the declared element count. Without a sufficient check against the actual received payload size, conversion can advance beyond the data supplied on the wire. The central failure is a mismatch between a declared count and the size of the memory object holding the data.
Under AddressSanitizer, Cipher confirmed a heap-buffer-overflow read and crash. It did not demonstrate disclosure of memory contents to a remote client. PR #934 adds validation of the count and the corresponding payload size before conversion.
4. A pvAccess field is cast to the wrong type (CVE-2026-114598)
Impact: During early pvAccess connection validation, a deserializer accepts a field type inconsistent with the enclosing array’s expected element type. Subsequent code treats the field as a structure or union anyway. CISA rates the issue High, CVSS 7.5.
Unlike Channel Access, pvAccess can describe complex, nested data types on the wire. When decoding an array-of-structure or array-of-union description, the vulnerable implementation casts the decoded element to the expected type without first establishing that it actually has that type. A differently typed element can therefore reach code that interprets the object through the wrong layout, including pointer-bearing fields.
In Cipher’s AddressSanitizer build, the malformed connection-validation exchange produced a heap-buffer-overflow read along the type-confused path, leading to a server-thread crash. The fix in pvDataCPP PR #109 validates complex element types and separately bounds deserialization recursion. It is included in the EPICS 7.0.11 release.
Why this matters beyond a parser crash
An IOC can perform monitoring, data acquisition, and control of equipment within a larger instrument. Interrupting it may deprive operators or automation of observations or control functions. What happens next depends on the facility’s architecture, redundancy, fail-safe behavior, and independent protection or safety interlocks. The Critical issue raises a different concern. If memory corruption could be turned into code execution in an exposed IOC process, an attacker could potentially act with that process’s privileges. The consequences would then depend on what that IOC is authorized to observe or command.
The breadth of EPICS deployment makes remediation a supply-chain issue as well as an individual IOC issue. A facility may run EPICS through an internally maintained application, while another may receive it inside a vendor-provided controller or beamline package.
How Cipher found and validated them
Cipher is an autonomous security system built to investigate unfamiliar software and infrastructure, including systems with no source code or documentation. It reasons independently about technology it has not seen before, formulates and tests attack hypotheses through real execution in a secure environment, and reliably turns them into validated security findings.
On EPICS, Cipher traced each wire-controlled count, length, and decoded type to the point where it sizes an allocation, indexes memory, or is cast. It built the affected components in an isolated sandbox and reproduced all four itself under AddressSanitizer or a debugger, each against a negative control that separates the fault from ordinary protocol behavior.
Reproduction payloads are not published here; the linked upstream patches show the validation failures each fix closes.
What operators and maintainers should do
For operators: Inventory the EPICS Base versions and protocol servers in use, including vendor-supported distributions and custom-built IOCs. Upgrade affected EPICS 7 deployments to 7.0.11, or obtain a supported backport. Restrict the relevant TCP services to the control hosts and networks that need them. Check for unexpected network paths across management, remote-access, research, guest, or bridged segments, and continue using configured IOC access-security mechanisms where applicable.
Take care with rollout. The EPICS 7.0.11 release notes warn that the stricter Channel Access message validation may affect interoperability with older CA clients. Test legacy clients and downstream integrations before deploying changes to production control systems.
For vendors and downstream maintainers: Verify whether your packaged EPICS components include the affected Channel Access or classic pvAccess implementation, and whether the fixes from PR #934 and PR #109 are present. Publish version-specific guidance or backported builds for customers who cannot immediately adopt a full upstream update. For future parser changes, cross-check wire-controlled lengths against actual buffer size before allocation or conversion, use overflow-safe arithmetic, and validate decoded types before casting or dereferencing them.
Coordinated disclosure
Cipher found and validated the four issues; Causal Security then reported them to the EPICS security channel on 9 June 2026 and coordinated with CISA on CVE assignment and downstream notification, so the vulnerabilities could be addressed before public disclosure. The Channel Access fix was merged in PR #934 on 23 July 2026, followed by the pvDataCPP fix in PR #109 on 10 August 2026. The maintainers’ pull requests acknowledge the confidential report from Shubham Raj and also note subsequent, overlapping independent reports.
The EPICS Base 7.0.11 release and CISA’s ICSA-26-300-01 were published on 27 October 2026. We thank the EPICS maintainers for developing and shipping the fixes, and the CISA ICS team for coordinating disclosure.
This research is part of Cipher’s work on vulnerability research and the open-source and embedded software used across critical systems.