security

One critical, three high-severity EPICS bugs could disrupt research experiments

An autonomous AI agent discovered four vulnerabilities in the decades-old, widely used EPICS (Experimental Physics and Industrial Control System) open source software toolkit, including a critical flaw that could allow remote attackers to execute code on systems used to control particle accelerators and fusion experiments.

The bugs include a critical, 9.8-rated under CVSS v3.1 integer overflow vulnerability ( CVE-2026-114595 ), leading to an attacker-controlled out-of-bounds heap write and potentially remote code execution; an 8.2-rated, high-severity, improper message-length validation flaw ( CVE-2026-114596 ), causing an out-of-bounds memory write and controller-process crash; a 7.5-rated, high-severity insufficient bounds checking bug ( CVE-2026-114597 ) that allows out-of-bounds memory reads and process crashes; and a 7.5-rated, high-severity type confusion flaw ( CVE-2026-114598 ) that can lead to denial of…