CVE-2026-68907: falha de alta gravidade em mz-automation libiec61850
libIEC61850: Server-side out-of-bounds stack read in association-specific dynamic dataset creation due to reversed StringUtils_copyStringToBuffer arguments
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.4%
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtils_copyStringToBuffer while constructing an MMS_ASSOCIATION_SPECIFIC dataset reference. The helper treats uninitialized dataSetRef[130] storage as a source string, causing strlen to read beyond the stack buffer, and then copies those bytes into the caller-owned listName buffer. A remote defineNamedVariableList request can crash servers that have dynamic dataset service enabled and a dataset access handler installed; the advisory also observes caller stack corruption but establishes denial of service as the primary impact. This issue is fixed in version 1.6.2.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
mz-automation · libiec61850CVEs relacionadas — mz-automation libiec61850
No mesmo produto, das mais perigosas para as menos.
CVE-2020-15158HIGHHeap buffer overflow in libIEC61850EPSS 2.0%CVE-2019-1010300—CVE-2019-1010300EPSS 1.3%CVE-2026-18583MEDIUMmz-automation libiec61850 MMS Request mms_mapping.c checkDataSetAccess out-of-boundsEPSS 0.9%CVE-2026-18582MEDIUMmz-automation libiec61850 Report Sending Path reporting.c Reporting_RCBWriteAccessHandler free of memory not on the heapEPSS 0.9%CVE-2026-48741HIGHlibIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoSEPSS 0.5%CVE-2026-68906HIGHlibIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDUEPSS 0.5%