CVE-2026-56758 identifies a heap buffer over-read vulnerability in the ACSE layer of the libiec61850 library by MZ Automation GmbH. The issue arises during the processing of AARQ PDUs in MMS connection establishment. Specifically, when parsing certain fields within the calling AP title, an attacker can supply a length value of zero or one, which leads to the parser reading past the end of a heap buffer. This vulnerability is categorized under CWE-125 and has a CVSS 3.1 base score of 6.5, indicating a medium severity level. There is no vendor advisory or patch information available at this time, and no known exploits have been reported in the wild.

The vulnerability allows an attacker to cause a heap buffer over-read during MMS connection establishment, potentially leading to application instability or denial of service. The CVSS vector indicates the attack requires adjacent network access (AV:A), no privileges (PR:N), no user interaction (UI:N), and impacts availability (A:H) without affecting confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigations or workarounds are provided in the available data.