EUVD-2026-51339
GHSA-fvf5-gmx7-5jwx
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:A confirmed by MMS/ACSE protocol's OT network context; C:N and I:N because the out-of-bounds read causes a crash, not data exfiltration or tampering.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
3DescriptionCVE.org
The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, an attacker controlled length value of zero or one may cause the parser to read past the end of a heap buffer.
AnalysisAI
Out-of-bounds heap read in MZ Automation GmbH libiec61850 (all versions before 1.6.2) allows an unauthenticated adjacent-network attacker to crash an MMS server by sending a crafted AARQ PDU with a zero or one-byte length value in the calling AP title field during connection establishment. The ACSE parser fails to bounds-check the attacker-controlled length, reading past the end of a heap buffer and causing availability loss - a significant concern in IEC 61850 substation automation environments where device availability underpins grid protection and monitoring. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; a vendor patch (version 1.6.2) is available per CISA ICS advisory ICSA-26-211-10.
Technical ContextAI
libiec61850 is an open-source C library by MZ Automation GmbH implementing the IEC 61850 standard for communication between intelligent electronic devices (IEDs) in electrical substations. The protocol stack involved includes ACSE (Association Control Service Element), which manages connection establishment over MMS (Manufacturing Message Specification), itself carried over TCP/IP via the ISO transport stack (typically port 102). The AARQ (Association Request) PDU is the first message sent by an MMS client to initiate a session. Within the AARQ, the calling AP title (Application Process Title) identifies the initiating application entity using an ASN.1-encoded OID. The vulnerability (CWE-125: Out-of-bounds Read) arises because the parser uses an attacker-controlled length field - set to zero or one - without validating it against the actual allocated heap buffer size, causing the read pointer to advance past the buffer boundary. CPE cpe:2.3:a:mz_automation_gmbh:libiec61850:*:*:*:*:*:*:*:* confirms all versions of the library are affected up to the 1.6.2 fix. Although tags include 'Information Disclosure,' the CVSS vector (C:N) and primary impact (A:H) indicate the practical consequence is a crash, not memory leakage.
RemediationAI
Upgrade libiec61850 to version 1.6.2 or later, which is the vendor-confirmed patched release per EUVD-2026-51339. The CISA ICS advisory ICSA-26-211-10 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10) provides guidance and the CSAF machine-readable advisory is at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-10.json. For OT environments where immediate patching requires change-control windows or device downtime, implement strict network segmentation restricting MMS/ACSE traffic (TCP port 102) to only authorized engineering workstations and SCADA servers using ACLs or OT-aware firewalls - this removes adjacent-network attacker access and directly neutralizes the AV:A attack vector. A unidirectional security gateway (data diode) on the substation LAN boundary is a stronger compensating control but may affect legitimate bidirectional MMS traffic. Deep-packet inspection capable of filtering malformed ACSE AARQ PDUs is also viable but requires an OT-aware IDS/IPS that understands IEC 61850 framing. All compensating controls should be tested in a lab environment before deployment to avoid unintended disruption to protection relay communications.
More in Libiec61850
View allAn issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c in libIEC61850 through 1.4.0 has a heap-based buffer ov
In libIEC61850 1.4.0, MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c has a heap-based buffer overflow.
In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the mmsServer_handleFileCloseRequest.c f
An issue in mz-automation libiec61850 v.1.5.3 and before, allows a remote attacker to cause a denial of service (DoS) vi
libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClient_setOrigin() a
A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec6185
libIEC61850 through 1.3.3 has a use-after-free in MmsServer_waitReady in mms/iso_mms/server/mms_server.c, as demonstrate
mz-automation libiec61850 1.3.2 1.3.1 1.3.0 is affected by: Buffer Overflow. Rated high severity (CVSS 7.5), this vulner
An issue has been found in libIEC61850 v1.3.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitabl
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today