libIEC61850 EUVD-2026-102909

Exploitable only on servers where the MMS file service is enabled AND the ObtainFile operation is permitted - if the file service is disabled (a common hardened default), the vulnerable code path is unreachable. The attacker must send a specific two-step sequence: a first ObtainFile that succeeds, followed by a second ObtainFile that reuses the freed task and causes destination-file creation to fail, which invokes the MMS_FILE_UPLOAD_STATE_SEND_OBTAIN_FILE_ERROR_DESTINATION cleanup that closes the stale handle again. Per CVSS PR:N no authentication is required, but reachability is typically limited to the substation/automation network segment rather than the open internet; impact is limited to availability (server crash) with no data exposure.

This is a genuine but moderate-severity denial-of-service issue, not a high-priority emergency. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3 MEDIUM) is internally consistent with the description: a remote, unauthenticated (PR:N), low-complexity request sequence causes a double-free (CWE-415) that crashes the server, with availability-only impact (A:L) and no confidentiality or integrity effect. The real-world risk is bounded by two factors the raw score understates: exploitation is only possible when the MMS file service AND the ObtainFile operation are explicitly enabled (not universal defaults), and the product is niche OT/ICS middleware rather than mass-deployed software. No EPSS score, SSVC decision, KEV listing, or public POC was provided in the input; exploitation status is therefore 'no public exploit identified at time of analysis.' However, the fixing commit (d86b4a9) is public and clearly shows the vulnerable success-then-failure double-close path, which lowers the barrier to writing a working exploit even though none is confirmed public. Conflicting-signal note: the CVSS claims PR:N (unauthenticated), but MMS associations and the file service are typically reachable only inside segmented substation networks, so the practical attack surface is narrower than AV:N implies - verify exposure against your network architecture.

An attacker with network reach to an MMS server that has the file service and ObtainFile enabled issues one ObtainFile request that completes successfully (closing the file handle but leaving a stale non-NULL pointer in the task), then issues a second ObtainFile that reuses the same task and is crafted so destination creation fails. The error-cleanup path then closes the already-freed FILE object a second time, triggering a double-free that crashes the server. No public exploit code was identified, but the public patch commit directly reveals the triggering sequence.