CVE-2026-19206mediumCWE-119CWE-122

CVE-2026-19206: fallo de gravedad media en MZ Automation libiec61850

MZ Automation libiec61850 ASDU Element sv_subscriber.c SVReceiver_stopThreadless heap-based overflow

Publicada el

Seguir esta CVE+ Monitorear libiec61850

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 4.8epss 0.2%
A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiver_stopThreadless of the file src/sampled_values/sv_subscriber.c of the component ASDU Element Handler. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.2 is able to mitigate this issue. The patch is named a96bd674e0238276dd1387d31d52e55229d0771e. The affected component should be upgraded.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
MZ Automation · libiec61850
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — MZ Automation libiec61850

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-3976MEDIUMMZ Automation libiec61850 MMS File Services mms_client_files.c path traversalEPSS 0.5%CVE-2026-19259MEDIUMMZ Automation libiec61850 MMS Protocol Workflow iec61850_common.c MmsMapping_varAccessSpecToObjectReference heap-based overflowEPSS 0.2%CVE-2026-19108MEDIUMMZ Automation libiec61850 URCB Revalidation reporting.c deleteDataSetValuesShadowBuffer use after freeEPSS 0.2%