Is there a patch available for CVE-2026-66349?

Yes, a patch is available for CVE-2026-66349. Update the affected software to the latest version immediately.

libiec61850 CVE-2026-66349

Q: What is the CVSS score of CVE-2026-66349?

CVE-2026-66349 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-51340 MEDIUM

Out-of-bounds Read (CWE-125)

2026-07-30 icscert

GHSA-8m3p-4g59-6h2r

Buffer Overflow Information Disclosure Libiec61850

6.9

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Adjacent network access required for MMS session; no authentication enforced; impact is strictly availability via process crash, with no confidentiality or integrity effect.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 23:22 vuln.today

CVSS changed

Jul 30, 2026 - 23:22 NVD

6.5 (MEDIUM) 6.9 (MEDIUM)

Patch available

Jul 30, 2026 - 23:04 EUVD

DescriptionCVE.org

The MMS server connection handler contains a flaw in its processing of BER-encoded request data. When an MMS confirmed request PDU containing an extended BER tag is received over an established session, the decoder may advance its internal buffer incorrectly due to a missing bounds check. This results in a one byte heap out-of-bounds read and causes the MMS service process to terminate, leading to a denial-of-service condition.

AnalysisAI

Denial-of-service in MZ Automation GmbH libiec61850 (all versions before 1.6.2) allows an adjacent unauthenticated attacker to crash the MMS server process by sending a crafted BER-encoded confirmed request PDU containing an extended BER tag over an established MMS session. The missing bounds check in the buffer decoder causes a one-byte heap out-of-bounds read, terminating the MMS service and disrupting IEC 61850-based industrial control communications. No active exploitation is confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.

Technical ContextAI

libiec61850 (CPE: cpe:2.3:a:mz_automation_gmbh:libiec61850:*:*:*:*:*:*:*:*) is an open-source C library by MZ Automation GmbH implementing the IEC 61850 standard used extensively in power utility automation and SCADA/OT environments. The Manufacturing Message Specification (MMS) component of IEC 61850 uses ASN.1 BER (Basic Encoding Rules) encoding for client-server request/response PDUs. The flaw is rooted in CWE-125 (Out-of-bounds Read): when the MMS connection handler decodes a confirmed request PDU containing an extended BER tag (multi-byte tag encoding), it fails to verify the buffer has sufficient bytes remaining before advancing the internal read pointer. This results in a one-byte heap OOB read that causes the MMS service process to crash. The ICS advisory origin (icscert) and ENISA EUVD-2026-51340 classification confirm this is an OT-specific vulnerability. The 'Information Disclosure' tag appears to describe the CWE-125 read primitive class rather than actual data exfiltration, as the CVSS vector explicitly lists C:N.

RemediationAI

Upgrade libiec61850 to version 1.6.2 or later, which introduces the missing bounds check in the BER tag decoder. This fix is confirmed available per CISA ICS Advisory ICSA-26-211-10 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10) and ENISA EUVD-2026-51340. Where immediate patching is not feasible in operational technology environments, restrict network access to the MMS service port (typically TCP 102) using firewall ACLs or network segmentation to allowlist only known, trusted MMS client IP addresses - this directly addresses the AV:A attack vector. Note that blanket blocking of TCP 102 will prevent all legitimate IEC 61850 MMS communications; a precise allowlist-based approach is strongly preferred over disabling MMS entirely. Consult the CSAF advisory at the GitHub reference for any additional vendor-specific mitigations or deployment guidance.