libiec61850 CVE-2026-66349

The attacker must be on a network adjacent to the MMS server - routable to TCP port 102 from the same OT/ICS network segment. An MMS application-layer session must be initiated; per the CVSS PR:N vector, no authentication credentials are required to establish this session, consistent with common IEC 61850 deployments that rely on network segregation rather than per-session authentication. The vulnerable code path is triggered specifically by a confirmed request PDU containing an extended (multi-byte) BER tag - this is a non-default but valid encoding the library must handle. Limiting factors: AV:A restricts exploitation to attackers already inside the OT network perimeter; the impact is strictly DoS (no privilege escalation or code execution due to a one-byte read, not write, OOB); exploitation does not persist across MMS service restart. Default internet-exposed deployments of libiec61850 are not the target - this affects embedded OT/SCADA systems where MMS is reachable on a plant or substation LAN.

The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields a score of 6.5, reflecting high availability impact with low attack complexity but constrained to adjacent-network attackers. The AV:A restriction is the most significant risk-reducing factor: the attacker must have network adjacency to the MMS service (typically TCP port 102), which in IEC 61850 deployments means the isolated OT/ICS network segment. This is not exploitable from the open internet without prior network access. No EPSS score was provided in the input data; risk probability cannot be quantified probabilistically. The absence of a KEV listing and no identified public POC further reduce near-term exploitation likelihood. However, in OT/ICS contexts, even a DoS impact carries elevated operational consequence - MMS service termination disrupts real-time command and monitoring in power grid and substation automation systems, where high availability is a safety requirement. The 'Buffer Overflow' tag is slightly misleading; the actual impact is a read OOB, not a write, so code execution is not a realistic outcome from this specific flaw.

An attacker with access to the OT network segment hosting the libiec61850 MMS server establishes a standard MMS application session on TCP port 102 and transmits a crafted confirmed request PDU in which the BER-encoded payload uses an extended (multi-byte) tag field. The decoder advances its buffer pointer without checking remaining capacity, reads one byte beyond the heap allocation boundary, and the resulting memory access violation terminates the MMS service process - denying all IEC 61850 communications served by that instance. No public proof-of-concept exploit has been identified at time of analysis, but the primitive is straightforward to construct from the description alone.