Threats affecting pkg:github/mz-automation/libiec61850

CVE-2026-68906 is a high-severity out-of-bounds read vulnerability in the mz-automation libiec61850 library prior to version 1.6.2. It occurs in the parseUserInformation function when handling malformed AARE PDUs during association, leading to an infinite CPU loop or a one-byte out-of-bounds read that can cause process abort. The flaw is due to improper validation of a negative buffer position returned by BerDecoder_decodeLength. This issue is fixed in version 1.6.2.

An out-of-bounds read vulnerability exists in libIEC61850 versions prior to 1.6.2 due to improper argument handling in the checkDataSetAccess function. This leads to reading beyond a stack buffer when processing a remote defineNamedVariableList request, causing potential server crashes and denial of service. The issue is fixed in version 1.6.2.

A vulnerability in libIEC61850 prior to version 1.6.2 allows a remote client to cause a server crash by triggering an invalid free of memory not on the heap. This occurs when an oversized RptID longer than 129 bytes is written, leading to improper handling and freeing of a stack-backed buffer during report serialization. The issue is fixed in version 1.6.2.

CVE-2026-57446 is a double free vulnerability in the mz-automation libiec61850 library versions 1.6.1 up to but not including 1.6.2. The flaw occurs during the MMS ObtainFile operation where a file handle is closed but a stale non-NULL pointer remains. If a subsequent ObtainFile request reuses the task and destination creation fails, the stale file handle is closed again, leading to a server crash. This vulnerability affects servers with the MMS file service and ObtainFile enabled. The issue is fixed in version 1.6.2.

A vulnerability in libIEC61850 prior to version 1.6.2 allows remote attackers to cause a denial of service via a NULL pointer dereference. The issue arises from improper validation of an alternate-access sub-array range in the MMS Read service, leading to a crash when handling out-of-range array indices in data models containing arrays.

CVE-2026-48503 is an integer underflow vulnerability in the MMS file service of libIEC61850 versions prior to 1.6.2. The flaw allows an unauthenticated remote client to cause an out-of-range initialPosition in fileOpen, leading to an oversized response that can disclose stale data from previous responses. This can result in information disclosure without authentication. The issue is fixed in version 1.6.2.

A vulnerability has been found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function MmsMapping_varAccessSpecToObjectReference of the file src/iec61850/common/iec61850_common.c of the component MMS Protocol Workflow. Such manipulation of the argument GetNamedVariableListAttributesResponse.itemId leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A heap-based buffer overflow vulnerability exists in MZ Automation libiec61850 versions 1.6.0 and 1.6.1 in the SVReceiver_stopThreadless function of the ASDU Element Handler component. The flaw can be triggered by a local attacker manipulating the affected function. Exploit code has been publicly released. Upgrading to version 1.6.2 mitigates the issue.

CVE-2026-19108 is a use-after-free vulnerability in MZ Automation libiec61850 versions 1.6.0 and 1.6.1. It affects the function deleteDataSetValuesShadowBuffer in the URCB Revalidation component. The vulnerability requires local access to exploit and has a medium severity score of 4.8. An exploit has been publicly disclosed. Upgrading to version 1.6.2 addresses the issue.

CVE-2026-18583 is a medium severity vulnerability in mz-automation libiec61850 versions 1.6.0 and 1.6.1. It involves an out-of-bounds read in the checkDataSetAccess function of the MMS Request Handler component. The vulnerability can be triggered remotely without authentication. A public exploit is available. Upgrading to version 1.6.2 addresses the issue.

CVE-2026-18582 is a medium severity vulnerability in mz-automation libiec61850 versions 1.6.0 and 1.6.1. It involves a flaw in the Reporting_RCBWriteAccessHandler function that causes a free of memory not on the heap, which can be exploited remotely. A public exploit exists. Upgrading to version 1.6.2 resolves the issue.

libiec61850 v1.5 was discovered to contain a heap overflow via the BerEncoder_encodeLength function at /asn1/ber_encoder.c.

In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the mmsServer_handleFileCloseRequest.c function of src/mms/iso_mms/server/mms_file_service.c. The vulnerability manifests as SEGV and causes the application to crash

Buffer Overflow vulnerability in mz-automation.de libiec61859 v.1.4.0 allows a remote attacker to cause a denial of service via the mmsServer_handleGetNameListRequest function to the mms_getnamelist_service component.