libiec61850 CVE-2026-49035

Exploitation requires network reachability to a service that embeds libiec61850 and accepts MMS connections, and is triggered specifically by a malicious MMS Initiate request (the protocol's connection-establishment message, normally over ISO-on-TCP/COTP on TCP port 102) - no authentication (PR:N) and no user interaction (UI:N) are needed. Reliable remote code execution is limited to configurations where ASLR is disabled, as explicitly stated; with ASLR enabled the realistic outcome is memory corruption or denial of service rather than RCE. Additional limiting factors reflected in the CVSS vector are high attack complexity (AC:H) and a specific attack requirement (AT:P), indicating exploitation depends on target memory layout/allocator state and is not trivially repeatable across all deployments.

The signals are mixed and warrant nuanced prioritization. The vendor/reporter CVSS 4.0 base of 9.2 (AV:N/AC:H/AT:P/PR:N/UI:N, VC/VI/VA:H) reflects an unauthenticated, network-reachable, high-impact bug - but crucially both AC:H (high attack complexity) and AT:P (a specific attack requirement) encode that reliable RCE is conditional, matching the description's statement that code execution was only demonstrated with ASLR disabled. On modern, ASLR-enabled targets the realistic outcome degrades to memory corruption or denial of service, which for OT/ICS availability-critical systems is still serious. There is no EPSS score, no KEV listing, and no POC referenced in the provided data, so there is no evidence of active exploitation - this is a high-severity-but-conditional issue rather than a confirmed mass-exploited threat. Note the tension to verify with the vendor: the record tags 'RCE' and scores full CIA impact, yet the description qualifies RCE as demonstrated only under a non-default hardening configuration (ASLR off); defenders on hardened hosts should weight the DoS/corruption outcome more heavily.

An attacker with network reachability to an exposed IEC 61850 MMS server (port 102) sends a single crafted MMS Initiate request during session setup, overflowing a heap buffer in libiec61850's parser. On a target where ASLR is disabled, the corruption is leveraged to execute arbitrary code in the context of the MMS service; on a hardened target it instead crashes the process, dropping the substation device offline. No authentication or user interaction is required, though building a reliable exploit is non-trivial (CVSS AC:H/AT:P) and no public POC is referenced.