libIEC61850 CVE-2026-68908

Requires a reachable libIEC61850-based MMS server (version prior to 1.6.2) with reporting/report-control-blocks in use, and the ability to establish a client association and perform a write to a report control block's RptID attribute with a value longer than 129 bytes, followed by generating a report via General Interrogation (GI) to reach the vulnerable sendNextReportEntrySegment serialization. Limiting factors: exploitation depends on the reporting feature being exercised (GI-triggered serialization), the server being accessible on the network/OT segment, and the client being permitted to write the RCB; impact is confined to a server crash (availability only), with no code execution, data disclosure, or integrity effect.

This is a genuine but limited-severity denial-of-service issue, not a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) indicates a remotely reachable, low-complexity bug with no confidentiality or integrity impact and only partial availability impact - consistent with CWE-590 (free of memory not on the heap), which here manifests as an invalid free that crashes the server process. No EPSS score, CISA KEV entry, or public POC is present in the provided intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. One signal to verify: the CVSS vector asserts PR:N (unauthenticated), but the description situates the flaw in the report-control-block write path, which in IEC 61850/MMS deployments normally requires an established client association - in hardened OT environments access may be network-restricted even if the protocol itself does not authenticate, so the practical attacker must already reach the MMS server on the substation network. The real-world risk is therefore moderate-to-low: a straightforward crash primitive, but confined to a niche ICS library, availability-only, with no code execution or data exposure.

An attacker with network reach to an MMS server built on libIEC61850 (<1.6.2) opens a client association and writes a report-control-block RptID value longer than 129 bytes, which the vulnerable Reporting_RCBWriteAccessHandler accepts. The attacker then triggers a General Interrogation so sendNextReportEntrySegment serializes the report, causing MmsValue_setVisibleString's resize path to free a stack-backed buffer (CWE-590) and crash the server. No public POC is identified, though the fixing commit diff publicly reveals the exact precondition (RptID > 129 bytes).