libIEC61850 CVE-2026-48741

Requires a reachable libIEC61850 MMS server running a version prior to 1.6.2 whose data model contains array-typed variables; the attacker sends an MMS Read using alternate array access with numberOfElements greater than zero and a sub-array range exceeding the array bounds (lowIndex + numberOfElements beyond MmsValue_getArraySize). No authentication is required (PR:N) and no user interaction is needed. LIMITING FACTORS: servers whose data models contain no arrays are not affected, and the single-element (non-sub-array) error path already handles the same invalid index safely, so only the array sub-access code path is vulnerable; impact is limited to a crash (availability) with no confidentiality or integrity effect.

This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with impact limited strictly to availability (C:N/I:N) - consistent with the described NULL pointer dereference (CWE-129) that crashes the MMS server. No EPSS score, SSVC decision, KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vendor-published GitHub Security Advisory (GHSA-8mfr-hq64-9w33), the fixing commit, and the v1.6.2 release tag confirm the root cause and remediation, lending high confidence to the technical details. The practical risk is tempered by a real precondition: only servers whose data models actually contain array-typed variables are affected, and the single-element error path already handles the same invalid index safely - so exploitability depends on target data-model design, not merely reachability. Net: a legitimate denial-of-service priority for exposed IEC 61850/MMS servers (especially in OT/substation contexts where availability is paramount), but not a remote-code-execution or data-breach event, and lower urgency than the 7.5 score alone implies given the array-model dependency and absence of any exploitation signal.

An attacker with network access to an exposed libIEC61850 MMS server (prior to 1.6.2) whose data model contains arrays sends a crafted MMS Read request using alternate array access with an out-of-range sub-array range and numberOfElements greater than zero. MmsValue_getElement returns NULL, the sub-array branch passes it to MmsValue_isDeletable, and the resulting NULL pointer dereference crashes the server, denying service. Exploitation is unauthenticated and low-complexity per the CVSS vector; no public exploit code was identified at time of analysis.