libiec61850 CVE-2026-50032

Exploitation requires the target to run an IEC 61850 MMS server built on libiec61850 and the attacker to be able to reach its MMS endpoint (typically TCP/102) and send a WriteRequest addressing a Named Variable List with an empty listOfData field - that malformed message IS the trigger. The primary limiting factor is network position: the description specifies a 'network adjacent' attacker, implying access to the same LAN/segment as the device rather than arbitrary internet reachability, which conflicts with the input's AV:N metric and should be verified. No authentication, user interaction, or non-default configuration is called out in the description beyond having the MMS Write service reachable.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H, base 8.7) rates this high, driven entirely by availability impact with no confidentiality or integrity effect and no privileges or user interaction required. However, the description explicitly says 'network adjacent attacker,' which conflicts with the AV:N (network) metric in the input - for MMS this typically means an attacker on the substation/process LAN rather than the open Internet, so real-world exposure depends on network segmentation; this discrepancy should be verified with the vendor/advisory. No EPSS score, SSVC decision, KEV listing, or public POC was provided, so exploitation likelihood cannot be quantified from the data; the signal set is thin. Practically, this is a reliability/uptime threat to ICS environments where availability is paramount, not a data-breach vector, and its true reachability hinges on whether MMS endpoints are exposed beyond a trusted network segment.

An attacker with a foothold on the substation or process network connects to an exposed MMS server built on libiec61850 and issues an MMS WriteRequest targeting a Named Variable List but omits the listOfData contents. The empty field triggers the NULL pointer dereference and the server process crashes, disrupting monitoring and control until it is restarted. No public exploit code was identified at time of analysis, and the attack requires only a single crafted, unauthenticated message.