Threats affecting pkg:github/mz-automation/lib60870

A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. The issue occurs because FileSegment_encode() validates only the standalone segment length via FileSegment_GetMaxDataSize() and does not verify the residual capacity of the current ASDU frame before encoding object fields and segment data

CVE-2026-63033 is a medium severity vulnerability in MZ Automation's lib60870 library. It involves a heap-based buffer over-read caused by a crafted IEC 60870-5-104 I-frame with an object count that exceeds the ASDU body size. This leads to the InformationObject_ParseObjectAddress function reading one byte beyond the allocated message buffer.

CVE-2026-61893 is a medium severity vulnerability in MZ Automation's lib60870 library version 2.4.0. It involves a heap buffer over-read caused by a crafted IEC 60870-5-104 I-frame with TypeID 104 and an inflated object count, leading the function TestCommand_getFromBuffer to read one byte past the allocated buffer.

A heap buffer overflow in the HighPriorityASDUQueue_hasUnconfirmedIMessages function of lib60870 v2.3.3 to v2.3.6 allows attackers to cause a Denial of Service (DoS) via a crafted payload.