EUVD-2026-54728
GHSA-36pq-cx6x-rc54
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector and low-privilege requirement confirmed by description and CVSS 4.0 source; limited partial impacts across CIA with unchanged scope.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function MmsMapping_varAccessSpecToObjectReference of the file src/iec61850/common/iec61850_common.c of the component MMS Protocol Workflow. Such manipulation of the argument GetNamedVariableListAttributesResponse.itemId leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Heap-based buffer overflow in MZ Automation libiec61850 up to version 1.6.1 allows a local attacker with low privileges to corrupt heap memory by supplying a crafted GetNamedVariableListAttributesResponse itemId argument to the MmsMapping_varAccessSpecToObjectReference function in the MMS Protocol Workflow. A public proof-of-concept exploit has been released and is available for download. The vulnerability has not yet been patched; the project was notified via GitHub issue #599 but has not responded at time of analysis. No active exploitation is confirmed by CISA KEV, though the publicly available PoC meaningfully elevates near-term risk.
Technical ContextAI
libiec61850 (CPE: cpe:2.3:a:mz_automation:libiec61850:*:*:*:*:*:*:*:*) is an open-source C library implementing the IEC 61850 standard used in electrical substation automation and power grid communication systems. The affected component is the MMS (Manufacturing Message Specification) protocol workflow, specifically the function MmsMapping_varAccessSpecToObjectReference in src/iec61850/common/iec61850_common.c. MMS is an ISO/IEC 9506 application-layer messaging protocol used to exchange real-time process data between intelligent electronic devices (IEDs). CWE-122 (Heap-based Buffer Overflow) identifies the root cause: the function fails to properly validate the length of the itemId field within a GetNamedVariableListAttributesResponse message before writing to a heap-allocated buffer, permitting an out-of-bounds write that corrupts adjacent heap memory. Such corruption in a C library can lead to arbitrary code execution, denial of service, or information leakage depending on heap layout and attacker control.
RemediationAI
No vendor-released patch is available at time of analysis; the vendor has not responded to the responsible disclosure via GitHub issue #599. As a compensating control, operators should restrict local system access to the minimum set of trusted users who require it, thereby reducing the attack surface since exploitation requires local, low-privileged access. Disabling or sandboxing processes that parse MMS GetNamedVariableListAttributesResponse messages from untrusted sources using OS-level controls (e.g., seccomp, AppArmor, or SELinux profiles) would prevent exploitation without requiring library changes - note this trade-off may limit MMS protocol functionality in devices relying on full IEC 61850 MMS attribute queries. Network segmentation that prevents unauthorized local shell or process access to ICS hosts running libiec61850 is also recommended. Monitor the upstream GitHub repository at https://github.com/mz-automation/libiec61850/issues/599 for vendor response and patch release.
More in Libiec61850
View allAn issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
An issue has been found in libIEC61850 v1.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploita
MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c in libIEC61850 through 1.4.0 has a heap-based buffer ov
In libIEC61850 1.4.0, MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c has a heap-based buffer overflow.
In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the mmsServer_handleFileCloseRequest.c f
An issue in mz-automation libiec61850 v.1.5.3 and before, allows a remote attacker to cause a denial of service (DoS) vi
libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClient_setOrigin() a
A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec6185
libIEC61850 through 1.3.3 has a use-after-free in MmsServer_waitReady in mms/iso_mms/server/mms_server.c, as demonstrate
mz-automation libiec61850 1.3.2 1.3.1 1.3.0 is affected by: Buffer Overflow. Rated high severity (CVSS 7.5), this vulner
An issue has been found in libIEC61850 v1.3.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitabl
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today