EUVD-2026-54486
GHSA-72v3-v5v5-6xx3
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
IEC 61850 SV frames are layer-2 Ethernet multicast requiring adjacency (AV:A); no application authentication to send frames (PR:N); heap overflow can crash subscriber process (A:H).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiver_stopThreadless of the file src/sampled_values/sv_subscriber.c of the component ASDU Element Handler. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.2 is able to mitigate this issue. The patch is named a96bd674e0238276dd1387d31d52e55229d0771e. The affected component should be upgraded.
AnalysisAI
Heap-based buffer overflow in MZ Automation libiec61850 up to version 1.6.1 allows an attacker on the adjacent IEC 61850 SV network segment to corrupt process memory by injecting malformed Sampled Values ASDU packets into the SVReceiver. The commit diff confirms that the parseASDU function in SVReceiver_stopThreadless assigned heap pointers for ASDU fields-svId, datSet, SmpCnt, ConfRev, RefrTm, SmpSynch, SmpRate, and SmpMod-without validating their lengths, enabling overflow via crafted field sizes. A public exploit has been released (E:P per CVSS 4.0 supplemental data); this vulnerability is not currently listed in CISA KEV but poses targeted risk to IEC 61850 substation automation and power grid environments.
Technical ContextAI
libiec61850 is an open-source C library implementing the IEC 61850 communication standard for electrical substation automation, widely used in SCADA, protection relays, and intelligent electronic devices (IEDs). The Sampled Values (SV) protocol, a layer-2 Ethernet multicast mechanism for transmitting real-time measurement data (current, voltage), is handled by the SVReceiver component. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) applies: the parseASDU function parsed incoming ASDU TLV elements and set heap pointers directly from untrusted packet data without first checking that field lengths matched expected values. The commit diff at a96bd674 shows that fixed-size fields such as SmpCnt (expected 2 bytes), ConfRev (4 bytes), RefrTm (8 bytes), SmpSynch (1 byte), SmpRate (2 bytes), and SmpMod (1 byte) had no length validation, and variable-length fields svId and datSet had no upper-bound enforcement prior to the 129-byte cap added in v1.6.2. A crafted SV packet with mismatched element lengths thus writes past the intended heap allocation.
RemediationAI
Upgrade libiec61850 to version 1.6.2 or later; the fix is commit a96bd674e0238276dd1387d31d52e55229d0771e, available at https://github.com/mz-automation/libiec61850/releases/tag/v1.6.2. For systems where an immediate upgrade is not operationally feasible, apply layer-2 VLAN segmentation to restrict which hosts are permitted to transmit IEC 61850 SV multicast frames to the subscriber-this reduces the attacker pool to already-trusted segment members, though it does not protect against a compromised node on the same segment. Deploying industrial unidirectional security gateways or layer-2 firewall ACLs on OT perimeter switches to drop SV frames from unknown sources provides an additional barrier. Note that these compensating controls introduce latency and visibility constraints that may affect real-time protection functions in substation environments and should be tested against operational requirements before deployment.
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today