CVE-2026-19108mediumCWE-119CWE-416

CVE-2026-19108: fallo de gravedad media en MZ Automation libiec61850

MZ Automation libiec61850 URCB Revalidation reporting.c deleteDataSetValuesShadowBuffer use after free

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear libiec61850

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 4.8epss 0.2%
A vulnerability was found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function deleteDataSetValuesShadowBuffer of the file src/iec61850/server/mms_mapping/reporting.c of the component URCB Revalidation. The manipulation results in use after free. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 1.6.2 is sufficient to fix this issue. The patch is identified as 486fd57f3aed65bb9d636ff00f9ddce2e450b168. Upgrading the affected component is advised.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
MZ Automation · libiec61850
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — MZ Automation libiec61850

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-3976MEDIUMMZ Automation libiec61850 MMS File Services mms_client_files.c path traversalEPSS 0.5%CVE-2026-19259MEDIUMMZ Automation libiec61850 MMS Protocol Workflow iec61850_common.c MmsMapping_varAccessSpecToObjectReference heap-based overflowEPSS 0.2%CVE-2026-19206MEDIUMMZ Automation libiec61850 ASDU Element sv_subscriber.c SVReceiver_stopThreadless heap-based overflowEPSS 0.2%