libIEC61850 EUVD-2026-102911

Exploitation requires the IEC 61850 server to have the dynamic dataset service enabled AND a dataset access handler installed - both non-default integration choices - and the attacker must send a defineNamedVariableList request that drives construction of an MMS_ASSOCIATION_SPECIFIC dataset reference, hitting the reversed-argument StringUtils_copyStringToBuffer call in checkDataSetAccess. No authentication is required (PR:N) and no user interaction is needed (UI:N), so any network-reachable attacker against a vulnerable configuration can trigger it; the limiting factor is purely the required server-side configuration (the AT:P / Attack Requirement), meaning servers without dynamic datasets or without an installed dataset access handler are not exposed.

The input CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) scores 8.2 and describes a remote, unauthenticated, availability-only impact with an Attack Requirement present (AT:P) - the latter aligns exactly with the description's precondition that the server have dynamic dataset service enabled and a dataset access handler installed. There is no CISA KEV listing and no EPSS score provided, so widespread or confirmed active exploitation cannot be asserted; a vendor commit diff is public (fix replacing StringUtils_copyStringToBuffer with bounded StringUtils_copyStringMax) but no weaponized proof-of-concept exploit is published, so this is 'no public exploit identified at time of analysis.' CWE-125 (out-of-bounds read) plus the advisory's own statement that denial of service - not code execution - is the primary impact means this is a crash/DoS bug, not an RCE, despite caller stack corruption being observed. Net assessment: a genuine but context-gated risk for operators running the vulnerable configuration in OT/ICS environments where availability is critical, rather than a mass-exploitable internet-wide emergency. Note the 'Information Disclosure' tag conflicts with the CVSS confidentiality metric (VC:N) and the advisory's DoS-primary framing - treat info-disclosure as theoretical/unconfirmed.

An attacker with network reachability to an IEC 61850 MMS server that has dynamic dataset service and a dataset access handler enabled sends a crafted defineNamedVariableList request constructing an MMS_ASSOCIATION_SPECIFIC dataset reference. The reversed source/destination arguments cause strlen to read past the uninitialized dataSetRef[130] stack buffer and copy out-of-bounds bytes into the listName buffer, crashing the server. No public exploit code exists, but the upstream fix commit discloses the exact defective code path.