CVE-2026-68906: falha de alta gravidade em mz-automation libiec61850
libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDU
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.5%
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path therefore swallows the error, reads buffer[-1], resets parsing to the beginning, and repeats the same malformed state. An unauthenticated remote peer can send a malformed AARE PDU during association to cause an infinite CPU loop under a normal allocator or a one-byte out-of-bounds read and process abort when the preceding byte is inaccessible. This issue is fixed in version 1.6.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
mz-automation · libiec61850CVEs relacionadas — mz-automation libiec61850
No mesmo produto, das mais perigosas para as menos.
CVE-2020-15158HIGHHeap buffer overflow in libIEC61850EPSS 2.0%CVE-2019-1010300—CVE-2019-1010300EPSS 1.3%CVE-2026-18583MEDIUMmz-automation libiec61850 MMS Request mms_mapping.c checkDataSetAccess out-of-boundsEPSS 0.9%CVE-2026-18582MEDIUMmz-automation libiec61850 Report Sending Path reporting.c Reporting_RCBWriteAccessHandler free of memory not on the heapEPSS 0.9%CVE-2026-48741HIGHlibIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoSEPSS 0.5%CVE-2026-48503HIGHlibIEC61850: Remote information disclosure in MMS file service via out-of-range initialPosition in fileOpen followed by fileReadEPSS 0.5%