Skip to main content

libiec61850 CVE-2026-18582

| EUVDEUVD-2026-52017 MEDIUM
Free of Memory not on the Heap (CWE-590)
2026-08-03 VulDB GHSA-vj8r-wqrg-59qf
Information Disclosure Libiec61850
5.5
CVSS 4.0 · Vendor: VulDB
Share

Severity by source

Vendor (VulDB) PRIMARY
5.5 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-reachable unauthenticated vector with no complexity; impact is restricted to a service crash with no confidentiality or integrity exposure, warranting A:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
CVSS changed
Aug 03, 2026 - 02:22 NVD
6.9 (MEDIUM) 5.5 (MEDIUM)
Source Code Evidence Fetched
Aug 03, 2026 - 02:21 vuln.today
Analysis Generated
Aug 03, 2026 - 02:21 vuln.today
CVE Published
Aug 03, 2026 - 01:15 cve.org
MEDIUM 6.9

DescriptionCVE.org

A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function Reporting_RCBWriteAccessHandler of the file src/iec61850/server/mms_mapping/reporting.c of the component Report Sending Path Handler. The manipulation results in free of memory not on the heap. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.2 is able to resolve this issue. The patch is identified as 5b2a69f44256b8548927d8afdd7ac5f5381abe1e. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.

AnalysisAI

Remote unauthenticated crash in mz-automation libiec61850 1.6.0-1.6.1 allows a network attacker to terminate an IEC 61850 MMS server by supplying an oversized Report ID string to the Report Control Block write handler, triggering a free of non-heap memory (CWE-590). No authentication or user interaction is required per the CVSS 4.0 vector (PR:N/UI:N/AV:N), and a public proof-of-concept exploit exists at the referenced GitHub issue. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Establish TCP connection to MMS server port 102
Delivery
Send MMS Write request targeting Report Control Block RptID attribute
Exploit
Supply RptID string exceeding 129 characters
Execution
Reporting_RCBWriteAccessHandler calls free() on non-heap pointer
Impact
IEC 61850 server process crashes
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The targeted host must run an IEC 61850 MMS server built with libiec61850 1.6.0 or 1.6.1 and must be reachable on its MMS port (typically TCP 102). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 6.9 (Medium) reflects a fully network-exploitable, unauthenticated vulnerability with no attack complexity or special conditions, but with only Low vulnerable-system availability impact (VA:L) and no confidentiality or integrity exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with TCP network access to port 102 on a host running an unpatched libiec61850-based IEC 61850 server sends a crafted MMS Write request to a Report Control Block, setting the RptID attribute to a string exceeding 129 characters. The Reporting_RCBWriteAccessHandler processes the oversized string and subsequently calls free() on a non-heap pointer, causing an immediate server process crash. …
Remediation Vendor-released patch: libiec61850 v1.6.2, available at https://github.com/mz-automation/libiec61850/releases/tag/v1.6.2 with the specific fix commit 5b2a69f44256b8548927d8afdd7ac5f5381abe1e at https://github.com/mz-automation/libiec61850/commit/5b2a69f44256b8548927d8afdd7ac5f5381abe1e. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Libiec61850

View all
CVE-2018-19185 CRITICAL POC
9.8 Nov 12

An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
CVE-2018-18957 CRITICAL POC
9.8 Nov 05

An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
CVE-2018-18834 CRITICAL POC
9.8 Oct 30

An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
CVE-2020-7054 HIGH POC
8.8 Jan 14

MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c in libIEC61850 through 1.4.0 has a heap-based buffer ov
CVE-2019-19931 HIGH POC
8.8 Dec 23

In libIEC61850 1.4.0, MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c has a heap-based buffer overflow.
CVE-2024-28286 HIGH POC
7.5 Mar 21

In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the mmsServer_handleFileCloseRequest.c f
CVE-2024-26529 HIGH POC
7.5 Mar 13

An issue in mz-automation libiec61850 v.1.5.3 and before, allows a remote attacker to cause a denial of service (DoS) vi
CVE-2023-27772 HIGH POC
7.5 Apr 13

libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClient_setOrigin() a
CVE-2022-21159 HIGH POC
7.5 Apr 15

A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec6185
CVE-2019-16510 HIGH POC
7.5 Sep 19

libIEC61850 through 1.3.3 has a use-after-free in MmsServer_waitReady in mms/iso_mms/server/mms_server.c, as demonstrate
CVE-2019-1010300 HIGH POC
7.5 Jul 15

mz-automation libiec61850 1.3.2 1.3.1 1.3.0 is affected by: Buffer Overflow. Rated high severity (CVSS 7.5), this vulner
CVE-2019-6719 HIGH POC
7.5 Jan 23

An issue has been found in libIEC61850 v1.3.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitabl

Same weakness CWE-590 – Free of Memory not on the Heap

View all
CVE-2022-31627 CRITICAL POC
9.8
CVE-2020-6016 CRITICAL POC
9.8
CVE-2022-31625 HIGH POC
8.1
CVE-2023-22291 HIGH POC
7.8
CVE-2021-42377 CRITICAL
9.8
CVE-2025-32911 CRITICAL
9.0
CVE-2026-20810 HIGH
7.8
CVE-2021-3939 HIGH
7.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-18582 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy