This vulnerability arises from inadequate validation of the length field in network messages received by EPICS Base. Because an attacker can send a message with a length that exceeds the actual payload, the application will read past the end of a buffer. The read can trigger a crash, resulting in denial of service, and the data read from adjacent memory may expose confidential information. The flaw fits CWE-130, Buffer Read Without Checking Size.

Affected users run EPICS Base from the EPICS Community consortium. The vulnerability is present in release 7.0.10 and all earlier versions. The fix is available in the 7.0.11 release; hunters should update to this version.

With a CVSS score of 8.7 the vulnerability is considered High severity. The EPSS indicator is not available, and the flaw is not listed in CISA’s KEV catalog, indicating no known widespread exploitation. However, because the flaw can be triggered by crafted network traffic, an attacker with network access can deliver the malicious packet and cause a crash or memory disclosure. The risk depends on exposure of the EPICS Base service to external networks.