Threat database

CVE-2026-68906 is a high-severity out-of-bounds read vulnerability in the mz-automation libiec61850 library prior to version 1.6.2. It occurs in the parseUserInformation function when handling malformed AARE PDUs during association, leading to an infinite CPU loop or a one-byte out-of-bounds read that can cause process abort. The flaw is due to improper validation of a negative buffer position returned by BerDecoder_decodeLength. This issue is fixed in version 1.6.2.

An out-of-bounds read vulnerability exists in libIEC61850 versions prior to 1.6.2 due to improper argument handling in the checkDataSetAccess function. This leads to reading beyond a stack buffer when processing a remote defineNamedVariableList request, causing potential server crashes and denial of service. The issue is fixed in version 1.6.2.

A vulnerability in libIEC61850 prior to version 1.6.2 allows a remote client to cause a server crash by triggering an invalid free of memory not on the heap. This occurs when an oversized RptID longer than 129 bytes is written, leading to improper handling and freeing of a stack-backed buffer during report serialization. The issue is fixed in version 1.6.2.

A double free vulnerability exists in mz-automation's libIEC61850 library versions 1.6.1 up to but not including 1.6.2. The flaw occurs during the MMS ObtainFile operation when a file handle is closed but a stale non-NULL value remains, leading to a second close attempt on the same handle if a subsequent request fails. This can cause the server to crash remotely. The issue is fixed in version 1.6.2.

A vulnerability in libIEC61850 prior to version 1.6.2 allows remote attackers to cause a denial of service via a NULL pointer dereference. The issue arises from improper validation of an alternate-access sub-array range in the MMS Read service, leading to a crash when handling out-of-range array indices in data models containing arrays.

CVE-2026-48503 is an integer underflow vulnerability in the MMS file service of libIEC61850 versions prior to 1.6.2. The flaw allows an unauthenticated remote client to cause an out-of-range initialPosition in fileOpen, leading to an oversized response that can disclose stale data from previous responses. This can result in information disclosure without authentication. The issue is fixed in version 1.6.2.

CVE-2026-18583 is a medium severity vulnerability in mz-automation libiec61850 versions 1.6.0 and 1.6.1. It involves an out-of-bounds read in the checkDataSetAccess function of the MMS Request Handler component. The vulnerability can be triggered remotely without authentication. A public exploit is available. Upgrading to version 1.6.2 addresses the issue.

CVE-2026-18582 is a medium severity vulnerability in mz-automation libiec61850 versions 1.6.0 and 1.6.1. It involves a flaw in the Reporting_RCBWriteAccessHandler function that causes a free of memory not on the heap, which can be exploited remotely. A public exploit exists. Upgrading to version 1.6.2 resolves the issue.