libIEC61850 EUVD-2026-102912

No special conditions beyond network reachability - remote unauthenticated exploitation against default configurations of libIEC61850 prior to 1.6.2, triggered during the normal ACSE association handshake before any authentication, by sending a malformed AARE PDU whose long-form length is truncated so BerDecoder_decodeLength returns a negative bufPos. The reliable outcome is CPU exhaustion (infinite loop) under a normal allocator; the process-abort variant is LIMITED to cases where the byte preceding the buffer lies in an inaccessible memory page, making that specific crash memory-layout dependent rather than guaranteed. Impact is confined to availability - no code execution, data disclosure, or integrity compromise.

All signals point to a genuine, patch-worthy denial-of-service issue rather than a hyped high-CVSS finding. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated flaw with no user interaction, and impact is purely availability (VC:N/VI:N/VA:H) - consistent with the description's infinite CPU loop / process abort and with CWE-125 (out-of-bounds read). The vendor-published GitHub Security Advisory (GHSA-f7xm-q62q-22cx), the fixing commit, and the 1.6.2 release tag all corroborate the root cause and fix, so vendor confirmation is strong. However, no EPSS score, no CISA KEV listing, and no public exploit are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; priority is driven by reachability and ease, not by observed attacks. One nuance to verify: the two outcomes differ in reliability - the infinite-CPU-loop DoS is reliable under a normal allocator, while the one-byte OOB read leading to process abort only occurs when the byte preceding the buffer is inaccessible, which is memory-layout dependent. Net: a real priority for OT/ICS operators exposing IEC 61850 endpoints, but it is a DoS (no confidentiality or integrity impact), so rank it below RCE-class issues.

An unauthenticated attacker with network reachability to a libIEC61850 server or client (versions prior to 1.6.2) sends a malformed AARE PDU with a truncated long-form length during the ACSE association phase. The decoder swallows the negative-length error, reads buffer[-1], and restarts parsing on the same malformed state, pinning a CPU core in an infinite loop or, if the preceding byte is inaccessible, aborting the process. No public exploit was identified at time of analysis, but the attack requires only a single crafted packet (AV:N/AC:L).