libIEC61850 EUVD-2026-102907

Requires the MMS file service to be enabled on the libIEC61850 server (not universally configured) and network reachability to the MMS/TCP listener; per CVSS PR:N the attack is unauthenticated. The attacker must specifically supply an out-of-range initialPosition in fileOpen (readPosition >= fileSize) to force the unsigned underflow in the fileRead path. Limiting factors: affected versions are strictly prior to 1.6.2; disclosure is confined to whatever stale bytes remain in the reused connection/send buffer, so the attacker cannot choose or guarantee the sensitivity of leaked data, and no availability or integrity impact occurs.

This is a genuine but moderate-priority information-disclosure flaw, not a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) correctly reflects network-reachable, unauthenticated, low-complexity access with no user interaction, which is why it scores HIGH - but the C:H rating appears generous: the leak is limited to stale bytes from the reused send/connection buffer after the requested file, which the attacker cannot target or fully control, making a C:L (limited, opportunistic disclosure) reading more defensible and the real severity closer to MEDIUM. No EPSS score, KEV listing, or POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation. There is no SSVC decision data supplied. The root cause is confirmed by the vendor commit (unsigned underflow of fileSize - readPosition, CWE-191, plus failure to bound the response to the actual FileSystem_readFile return). Net: real and worth patching, but absent exploitation signals it is a routine high-CVSS issue rather than an urgent widespread threat, further tempered because the MMS file service must be enabled for the vulnerable path to be reachable.

An unauthenticated attacker with network access to an exposed MMS server (IEC 61850 TCP/102) sends a fileOpen request specifying an initialPosition beyond the file's size, then issues a fileRead. The server's unsigned subtraction underflows to a huge byteLeft value and returns an oversized response padded with leftover connection-buffer bytes from prior responses, leaking protocol fragments and earlier response data back to the client. No public POC is referenced; the attack is low-complexity given the described arithmetic flaw.