Which versions of libiec61850 are affected by CVE-2026-50032?

MZ Automation's libiec61850 library contains a critical denial-of-service vulnerability affecting IEC 61850 MMS servers widely deployed in electric-power protection relays, RTUs, and SCADA systems.

How to fix or mitigate CVE-2026-50032?

Within 24 hours, inventory all systems embedding libiec61850 as MMS servers (protection relays, RTUs, gateways, SCADA front-ends) and identify those in production; prioritize systems with highest operational criticality. Within 7 days, implement network segmentation to restrict WriteRequest traffic to MMS servers to trusted administrative interfaces only, deploy network-based intrusion detection configured to flag malformed WriteRequest packets with empty listOfData fields, and disable MMS remote access where operationally feasible. Within 30 days, establish continuous monitoring for vendor security advisories, develop a patching timeline based on MZ Automation's release of version updates, and evaluate alternative MMS implementations or air-gapped deployments for highest-criticality systems.

libiec61850 CVE-2026-50032

Q: What is the CVSS score of CVE-2026-50032?

CVE-2026-50032 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-48397 HIGH

NULL Pointer Dereference (CWE-476)

2026-07-23 icscert

GHSA-37jp-3q9w-phcm

Denial Of Service Null Pointer Dereference Libiec61850

8.7

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Description states a network-adjacent attacker so AV:A over AV:N; a single unauthenticated malformed message crashes the server, giving PR:N/UI:N/AC:L and availability-only impact (A:H, C/I:N).

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:31 vuln.today

CVSS changed

Jul 23, 2026 - 21:23 NVD

7.5 (HIGH) 8.7 (HIGH)

CVE Published

Jul 23, 2026 - 20:53 cve.org

HIGH 8.7

DescriptionCVE.org

A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field.

AnalysisAI

Denial of service in MZ Automation's libiec61850 library allows a network-adjacent attacker to crash an IEC 61850 MMS server by sending a specially crafted WriteRequest whose listOfData field is empty, triggering a NULL pointer dereference (CWE-476) in the Write Named Variable List handler. Any device or application embedding the affected library as an MMS server - commonly protection relays, RTUs, gateways, and SCADA front-ends in electric-power and industrial environments - is exposed. Reported through CISA ICS-CERT (advisory ICSA-26-204-06) with no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

libiec61850 is a widely used open-source implementation of the IEC 61850 protocol suite (including MMS over ISO/TCP on port 102) used to build servers and clients for electrical substation automation and industrial control. The flaw lives in the MMS Manufacturing Message Specification 'Write' service path that handles a Named Variable List: when a WriteRequest arrives with an empty listOfData element, the handler dereferences a pointer that was never populated, matching CWE-476 (NULL Pointer Dereference). Because the crash occurs during message parsing/dispatch of a legitimate service, no data corruption or code execution results - the process simply faults and the server terminates, taking down the protocol endpoint.

RemediationAI

No vendor-released patch version was identified in the provided data, so the exact fixed release should be confirmed from the CISA advisory (https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-06) and the upstream libiec61850 project, then applied by upgrading the library and rebuilding/redeploying any product that embeds it. Until a patched build is deployed, apply network segmentation to restrict access to TCP port 102 (MMS/ISO-TCP) so only authorized SCADA/HMI hosts can reach the server - the standard ICS defense and the least disruptive control here; supplement with firewall/ACL allow-listing and consider a protocol-aware IDS rule to detect malformed WriteRequests. The trade-off of strict port 102 filtering is potential disruption to legitimate MMS clients if the allow-list is incomplete, so validate the client inventory before enforcing.