Which versions of libiec61850 are affected by CVE-2026-49035?

A critical remote code execution vulnerability in MZ Automation's libiec61850 IEC 61850 library poses an immediate threat to industrial control systems and critical infrastructure operators…

How to fix or mitigate CVE-2026-49035?

Within 24 hours, conduct a complete inventory of all systems, applications, and devices embedding MZ Automation's libiec61850 library and identify which hosts expose MMS/TCP port 102 to untrusted or external networks. Within 7 days, implement strict network access controls using firewalls and segmentation to restrict MMS/TCP port 102 to verified trusted internal networks only; enable ASLR on all affected Linux deployments; and configure alerting for anomalous MMS Initiate requests. Within 30 days, establish continuous monitoring of MZ Automation security advisories for patch availability and develop a phased remediation plan for all affected libiec61850 deployments.

libiec61850 CVE-2026-49035

Q: What is the CVSS score of CVE-2026-49035?

CVE-2026-49035 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-48430 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-07-23 icscert

GHSA-4r66-gmmr-3ww8

Denial Of Service Buffer Overflow RCE Heap Overflow Libiec61850

9.2

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

9.2 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Unauthenticated network-reachable MMS parser bug (AV:N/PR:N/UI:N) but reliable RCE needs ASLR disabled and favorable heap state, so AC:H; full CIA impact within the service process.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:31 vuln.today

Severity Changed

Jul 23, 2026 - 21:23 NVD

HIGH CRITICAL

CVSS changed

Jul 23, 2026 - 21:23 NVD

8.1 (HIGH) 9.2 (CRITICAL)

CVE Published

Jul 23, 2026 - 20:48 cve.org

CRITICAL 9.2

DescriptionCVE.org

The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled.

AnalysisAI

Remote code execution in MZ Automation's libiec61850 IEC 61850 library is possible via a crafted MMS Initiate request that triggers a heap-based buffer overflow (CWE-122); RCE was demonstrated on hosts with ASLR disabled, while ASLR-enabled deployments face memory corruption or denial of service. Any device or application embedding this library and exposing the MMS/TCP (typically port 102) service to attacker-reachable networks is affected. Reported through CISA ICS-CERT (ICSA-26-204-06); no public exploit identified at time of analysis and no EPSS/KEV signal is present in the source data.

Technical ContextAI

libiec61850 is a widely-used open-source C library implementing the IEC 61850 substation automation protocol suite, including MMS (Manufacturing Message Specification), GOOSE, and Sampled Values, used to build IEDs, gateways, RTUs, and SCADA client/server components in electric-power and industrial environments. The flaw is a CWE-122 heap-based buffer overflow reached during parsing of an MMS Initiate request - the session-establishment message an MMS client sends when connecting to a server over TCP (conventionally port 102 via ISO-on-TCP/COTP). Insufficient bounds validation of attacker-controlled fields in this early handshake corrupts heap metadata/allocations, which - depending on allocator state and memory-protection posture - can be steered toward control-flow hijack (RCE) or reduced to a crash (DoS).

RemediationAI

No vendor-released patch version is identified in the provided data - consult the CISA advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-06 for the fixed libiec61850 release and update to the vendor-specified patched version once confirmed, then rebuild and redeploy any downstream products that statically link the library. Until a patched build is deployed, apply compensating network controls: restrict MMS/TCP port 102 (ISO-on-TCP) to an explicit allowlist of trusted engineering/SCADA hosts via firewall or ACL, and place affected IEDs behind a segmented OT DMZ so untrusted networks cannot reach the MMS listener - trade-off is that legitimate remote clients must be enumerated and whitelisted, which can disrupt ad-hoc engineering access. Ensure ASLR (and DEP/NX) remain enabled on any general-purpose host running the library, since the description indicates ASLR materially degrades reliable RCE to a crash; note this hardens against code execution but does not prevent the underlying overflow or the resulting DoS. Monitor MMS Initiate traffic for anomalous/oversized requests where an IDS/DPI capability exists.