CVE-2026-19259
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the MZ Automation libiec61850 library up to version 1.6.1, a heap-based buffer overflow vulnerability was found in the MmsMapping_varAccessSpecToObjectReference function in src/iec61850/common/iec61850_common.c of the MMS Protocol Workflow component. Manipulating the GetNamedVariableListAttributesResponse.itemId argument leads to overflow. The attack requires local access, and the exploit is public.
Risk Assessment
Heap-based buffer overflow could allow a local attacker to execute arbitrary code or cause a system crash, potentially leading to security compromise or denial of service.
Recommendation
Restrict local access and monitor the project's response. Consider applying available patches or temporarily disabling the affected function.
Original NVD description (English source)
A vulnerability has been found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function MmsMapping_varAccessSpecToObjectReference of the file src/iec61850/common/iec61850_common.c of the component MMS Protocol Workflow. Such manipulation of the argument GetNamedVariableListAttributesResponse.itemId leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.