Skip to main content

libiec61850 CVE-2026-65421

| EUVDEUVD-2026-51342 HIGH
Out-of-bounds Read (CWE-125)
2026-07-30 icscert GHSA-rh3w-qc85-vjvv
Buffer Overflow Information Disclosure Libiec61850
7.1
CVSS 4.0 · Vendor: icscert
Share

Severity by source

Vendor (icscert) PRIMARY
7.1 MEDIUM
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

AV:A reflects MMS service adjacency requirement; PR:N as MMS connections require no credentials; A:H for service termination; C:N as crash precedes any confirmed data exfiltration.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
Analysis Generated
Jul 30, 2026 - 23:22 vuln.today
Severity Changed
Jul 30, 2026 - 23:22 NVD
MEDIUM HIGH
CVSS changed
Jul 30, 2026 - 23:22 NVD
6.5 (MEDIUM) 7.1 (HIGH)
Patch available
Jul 30, 2026 - 23:04 EUVD
CVE Published
Jul 30, 2026 - 22:35 cve.org
HIGH 7.1

DescriptionCVE.org

The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean/integer): an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-service condition.

AnalysisAI

Heap buffer over-read in MZ Automation GmbH's libiec61850 (versions prior to 1.6.2) allows an unauthenticated adjacent-network attacker to crash the MMS service process by sending a crafted BER-encoded message with an invalid length value in a BOOLEAN or INTEGER field. The MMS BER decoder performs no bounds validation on the attacker-supplied length, causing a read past the end of a heap-allocated buffer and subsequent process termination. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain adjacent network access
Delivery
Send crafted MMS BER message
Exploit
Supply invalid field length value
Execution
Trigger heap over-read in BER decoder
Persist
MMS service process terminates
Impact
Denial of service to IEC 61850 device
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target host must be running an application built on libiec61850 with its MMS server functionality active and reachable on the adjacent network (AV:A). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 6.5 score with AV:A (adjacent network) is the most significant risk-limiting factor - the attacker must have layer-2 or routed adjacent-network access to the MMS service, excluding open-internet attackers in properly segmented OT environments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with access to the substation LAN or industrial control network segment sends a crafted MMS connection request or data message containing a BER-encoded field (BOOLEAN or INTEGER type) with a length value exceeding the actual buffer allocation. The libiec61850 BER decoder trusts this length without validation, reads beyond the heap buffer boundary, and the resulting memory access violation terminates the MMS service process, severing all MMS communications to the affected IEC 61850 device. …
Remediation Upgrade libiec61850 to version 1.6.2 or later, which contains the vendor-released patch per CISA advisory ICSA-26-211-10 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10) and EUVD-2026-51342. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all systems and applications using libiec61850 versions prior to 1.6.2 and assess which are deployed in production or safety-critical environments. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Libiec61850

View all
CVE-2018-19185 CRITICAL POC
9.8 Nov 12

An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
CVE-2018-18957 CRITICAL POC
9.8 Nov 05

An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
CVE-2018-18834 CRITICAL POC
9.8 Oct 30

An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
CVE-2020-7054 HIGH POC
8.8 Jan 14

MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c in libIEC61850 through 1.4.0 has a heap-based buffer ov
CVE-2019-19931 HIGH POC
8.8 Dec 23

In libIEC61850 1.4.0, MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c has a heap-based buffer overflow.
CVE-2024-28286 HIGH POC
7.5 Mar 21

In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the mmsServer_handleFileCloseRequest.c f
CVE-2024-26529 HIGH POC
7.5 Mar 13

An issue in mz-automation libiec61850 v.1.5.3 and before, allows a remote attacker to cause a denial of service (DoS) vi
CVE-2023-27772 HIGH POC
7.5 Apr 13

libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClient_setOrigin() a
CVE-2022-21159 HIGH POC
7.5 Apr 15

A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec6185
CVE-2019-16510 HIGH POC
7.5 Sep 19

libIEC61850 through 1.3.3 has a use-after-free in MmsServer_waitReady in mms/iso_mms/server/mms_server.c, as demonstrate
CVE-2019-1010300 HIGH POC
7.5 Jul 15

mz-automation libiec61850 1.3.2 1.3.1 1.3.0 is affected by: Buffer Overflow. Rated high severity (CVSS 7.5), this vulner
CVE-2019-6719 HIGH POC
7.5 Jan 23

An issue has been found in libIEC61850 v1.3.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitabl

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8

Share

CVE-2026-65421 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy