CVE-2026-63033mediumCWE-125

CVE-2026-63033: medium-severity vulnerability in MZ Automation lib60870

MZ Automation lib60870 Out-of-bounds Read

Published · Updated

Follow this CVE+ Monitor lib60870

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.5%
A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAddress to read one byte past the end of the heap-allocated message buffer.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
MZ Automation · lib60870
Related CVEs — MZ Automation lib60870

In the same product, most dangerous first.

CVE-2026-61893MEDIUMMZ Automation lib60870 Out-of-bounds ReadEPSS 0.5%CVE-2026-16002HIGHOut-of-bounds Read in MZ Automation lib60870EPSS 0.4%