EUVD-2026-54260
GHSA-c2h4-j5j4-67wf
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only vector with low-privilege requirement; limited C/I/A impact consistent with use-after-free leading primarily to crash or constrained heap corruption.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function deleteDataSetValuesShadowBuffer of the file src/iec61850/server/mms_mapping/reporting.c of the component URCB Revalidation. The manipulation results in use after free. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 1.6.2 is sufficient to fix this issue. The patch is identified as 486fd57f3aed65bb9d636ff00f9ddce2e450b168. Upgrading the affected component is advised.
AnalysisAI
Use-after-free in MZ Automation libiec61850 up to version 1.6.1 allows a local low-privileged attacker to corrupt memory through the URCB (Unbuffered Report Control Block) dataset shadow buffer deletion path. The vulnerability exists in deleteDataSetValuesShadowBuffer within reporting.c, where the function dereferenced self->dataSet to compute its size after that pointer could already have been freed or set to NULL during connection teardown. A publicly available proof-of-concept exists, though no active exploitation has been confirmed via CISA KEV. The fix, released in v1.6.2 (commit 486fd57f), stores buffer size independently and adds semaphore locking to prevent the race.
Technical ContextAI
libiec61850 is an open-source C library implementing the IEC 61850 standard for substation automation and power grid communication, maintained by MZ Automation. The vulnerability resides in the URCB (Unbuffered Report Control Block) revalidation logic in src/iec61850/server/mms_mapping/reporting.c. The deleteDataSetValuesShadowBuffer function previously called DataSet_getSize(self->dataSet) to iterate over buffered values, but self->dataSet could already be NULL or freed by the time the function executed - particularly during MMS connection teardown when dynamic datasets are deleted. The commit diff confirms the fix: a new bufferedDataSetValuesSize field is added to the ReportControl struct, decoupling the iteration count from the live dataset pointer. Additionally, rcbValuesLock semaphore guards are added around dataset access in mms_mapping.c, and a NULL guard is inserted in MmsMapping_getDomainSpecificDataSet. CWE-119 (Improper Restriction of Operations within Bounds of a Memory Buffer) is the assigned class; CWE-416 (Use After Free) is the more precise sub-type based on the actual code behavior.
RemediationAI
Upgrade libiec61850 to version 1.6.2, which contains the confirmed fix at commit 486fd57f3aed65bb9d636ff00f9ddce2e450b268, available at https://github.com/mz-automation/libiec61850/releases/tag/v1.6.2. The patched release is available upstream; organizations embedding libiec61850 in OT devices or SCADA middleware must rebuild and redeploy dependent applications after updating the library. For environments where immediate patching is not possible, a targeted compensating control is to restrict local shell access to accounts that interact with the MMS server process, reducing the pool of potential exploiters since PR:L is required. Disabling dynamic dataset creation (if the application permits) eliminates the specific code path triggering the use-after-free, but this trades off reporting flexibility and may break legitimate IEC 61850 client functionality. No additional network-layer mitigations are applicable given the AV:L vector.
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today