This vulnerability (CVE-2026-63033) in lib60870 arises when a specially crafted IEC 60870-5-104 I-frame declares an object count larger than what fits in the ASDU body. The parsing function InformationObject_ParseObjectAddress then reads one byte past the end of the heap-allocated buffer, resulting in a heap-based buffer over-read (CWE-125). The CVSS 3.1 score is 6.5 (medium), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality and availability impact. No official patch or remediation level has been published by the vendor as of the data provided.

The vulnerability allows an attacker to cause a heap-based buffer over-read, which may lead to limited information disclosure and partial availability impact. There is no indication of integrity impact. Exploitation requires sending a crafted IEC 60870-5-104 I-frame over the network. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider network-level protections to restrict untrusted IEC 60870-5-104 traffic. No official remediation or temporary fix is currently documented.