libiec61850 CVE-2026-65421

The target host must be running an application built on libiec61850 with its MMS server functionality active and reachable on the adjacent network (AV:A). No authentication is required (PR:N) and no user interaction is needed (UI:N) - any host that can send TCP traffic to the MMS port can trigger the flaw. The triggering condition is specifically receipt of a BER-encoded MMS message containing a BOOLEAN or INTEGER field whose attacker-supplied length value exceeds the actual buffer size; no special server-side configuration beyond running the MMS service is required. Exploitation is bounded by adjacent-network reachability: in properly segmented OT architectures where MMS services are isolated behind process-network firewalls, internet-facing or enterprise-network attackers cannot directly reach the service. The 'Information Disclosure' tag suggests possible heap memory leakage under some conditions, but the description confirms the primary impact is process termination; whether data is exfiltrated before the crash is not confirmed from available data.

The CVSS 6.5 score with AV:A (adjacent network) is the most significant risk-limiting factor - the attacker must have layer-2 or routed adjacent-network access to the MMS service, excluding open-internet attackers in properly segmented OT environments. AC:L/PR:N/UI:N indicates that once adjacent, exploitation is straightforward and requires no credentials or user interaction, lowering the practical bar considerably. Impact is purely availability (A:H, C:N, I:N per the CVSS vector), meaning a successful attack crashes the service but does not exfiltrate data or modify state - though the 'Information Disclosure' tag in the source metadata is inconsistent with C:N and warrants independent verification against the vendor advisory. No EPSS score was provided, no KEV listing exists, and no public POC has been identified, placing this in a lower-urgency tier for most enterprise environments. However, the ICS-CERT attribution and IEC 61850 context elevate operational concern: MMS services in substation automation are often safety-critical or operationally critical, where a process crash during grid operations could have consequences disproportionate to the CVSS base score.

An attacker with access to the substation LAN or industrial control network segment sends a crafted MMS connection request or data message containing a BER-encoded field (BOOLEAN or INTEGER type) with a length value exceeding the actual buffer allocation. The libiec61850 BER decoder trusts this length without validation, reads beyond the heap buffer boundary, and the resulting memory access violation terminates the MMS service process, severing all MMS communications to the affected IEC 61850 device. No public proof-of-concept has been identified at time of analysis.