libiec61850 CVE-2026-19259

Local access to the target system is required - the attack cannot be executed remotely over a network. The attacker must hold at minimum low-privileged (user-level) local account credentials or equivalent process execution capability on the host running an application built against libiec61850 up to 1.6.1. The vulnerable code path is reached during processing of MMS protocol GetNamedVariableListAttributesResponse messages, so the target application must be actively processing such MMS messages at the time of exploitation. Limiting factors include: (1) physical or logical local access is mandatory, ruling out remote, unauthenticated exploitation; (2) the attacker must be able to supply or inject a crafted MMS response to the library's parsing routine; (3) the application must be using the MMS Named Variable List attribute query functionality. No special non-default configuration is known to be required beyond the application accepting MMS traffic.

The CVSS 4.0 base score of 4.8 (Medium) reflects the local attack vector (AV:L), which materially constrains exploitability compared to network-accessible flaws. The threat metric E:P (exploit code proof-of-concept) is included in the provided vector, acknowledging that a working PoC ZIP archive has been publicly released on GitHub. No CISA KEV listing exists, so confirmed active exploitation is unverified. The limited confidentiality, integrity, and availability impacts (VC:L/VI:L/VA:L) and the absence of scope change (SC:N/SI:N/SA:N) keep the numerical score moderate. However, the industrial control system (ICS) deployment context of IEC 61850 libraries is a critical risk amplifier not captured by CVSS: a heap overflow in a substation automation library could disrupt power grid operations even with partial memory corruption. The combination of a public PoC and an unresponsive vendor warrants elevated prioritization in ICS/OT environments despite the moderate CVSS. No conflicting signals between CVSS vector and description - local access requirement is consistent across all sources.

A local attacker with a standard user account on a system running an application built on libiec61850 constructs a malformed MMS GetNamedVariableListAttributesResponse packet containing an oversized or specially crafted itemId value. When the vulnerable application processes this response via MmsMapping_varAccessSpecToObjectReference, the heap buffer overflow corrupts adjacent heap memory, potentially enabling arbitrary code execution or process crash. A public PoC ZIP archive is available on GitHub, lowering the technical barrier for exploitation by less-skilled actors.