CVE-2026-18583mediumCWE-119CWE-125

CVE-2026-18583: medium-severity vulnerability in mz-automation libiec61850

mz-automation libiec61850 MMS Request mms_mapping.c checkDataSetAccess out-of-bounds

Published

Follow this CVE+ Monitor libiec61850

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.9epss 0.9%
A weakness has been identified in mz-automation libiec61850 up to 1.6.1. This issue affects the function checkDataSetAccess of the file src/iec61850/server/mms_mapping/mms_mapping.c of the component MMS Request Handler. This manipulation causes out-of-bounds read. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.6.2 is capable of addressing this issue. Patch name: 062062daf4cb50c7aa76e01d6fb4d58fc9278a7d. Upgrading the affected component is recommended. The vendor was contacted early about this disclosure.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
mz-automation · libiec61850
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — mz-automation libiec61850

In the same product, most dangerous first.

CVE-2020-15158HIGHHeap buffer overflow in libIEC61850EPSS 2.0%CVE-2019-1010300—CVE-2019-1010300EPSS 1.3%CVE-2026-18582MEDIUMmz-automation libiec61850 Report Sending Path reporting.c Reporting_RCBWriteAccessHandler free of memory not on the heapEPSS 0.9%CVE-2026-48741HIGHlibIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoSEPSS 0.5%CVE-2026-68906HIGHlibIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDUEPSS 0.5%CVE-2026-48503HIGHlibIEC61850: Remote information disclosure in MMS file service via out-of-range initialPosition in fileOpen followed by fileReadEPSS 0.5%