CVE-2026-19259 is a heap-based buffer overflow vulnerability in MZ Automation libiec61850 up to version 1.6.1. It affects the function MmsMapping_varAccessSpecToObjectReference in the file src/iec61850/common/iec61850_common.c, part of the MMS Protocol Workflow component. The vulnerability is triggered by manipulation of the GetNamedVariableListAttributesResponse.itemId argument. The attack vector is local with low complexity and requires privileges. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. The project was informed early but has not issued a fix or response. No known exploits are currently active in the wild.

Successful exploitation can lead to a heap-based buffer overflow, potentially allowing an attacker with local access and privileges to cause limited confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 5.3 (medium severity), reflecting local attack vector, low attack complexity, and required privileges. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The project has not responded or issued a fix as of the latest information. Until a patch is available, restrict local access to trusted users and monitor for unusual activity related to the affected component.