CVE-2026-48503

libIEC61850 prior to 1.6.2 does not validate the length of the RptID field in the report-control-block write path, accepting values longer than 129 bytes. When a report is later serialized, the function passes the stack-backed buffer rptIdBuf[130] to MmsValue_setVisibleString, whose resize path frees that buffer, causing an invalid free and server crash.

In libIEC61850, checkDataSetAccess reverses the source and destination arguments to StringUtils_copyStringToBuffer while constructing an MMS_ASSOCIATION_SPECIFIC dataset reference. This causes a stack buffer over-read and copies those bytes into the caller-owned listName buffer, potentially crashing the server on a defineNamedVariableList request.

In libIEC61850, parseUserInformation checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path swallows the error, reads buffer[-1], resets parsing, and repeats the same state, leading to an infinite CPU loop or an out-of-bounds read and process abort.

In libIEC61850 from 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes the file handle in a task but leaves a stale non-NULL value in a task marked as unused. If a later ObtainFile request reuses that task and destination creation fails, the cleanup path closes the stale FILE object again, allowing a remote crash of the server.

In libIEC61850, alternateArrayAccess does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValue_getElement call returns NULL, and the sub-array branch passes that value to MmsValue_isDeletable, causing a NULL pointer dereference. A remote MMS Read request can crash servers whose data models contain arrays. Fixed in 1.6.2.

libiec61850 version 1.6 contains a vulnerability in the parseGoosePayload() function in /goose/goose_receiver.c, allowing attackers to bypass authentication via a captured GOOSE frame.

In the MZ Automation libiec61850 library up to version 1.6.1, a heap-based buffer overflow vulnerability was found in the MmsMapping_varAccessSpecToObjectReference function in src/iec61850/common/iec61850_common.c of the MMS Protocol Workflow component. Manipulating the GetNamedVariableListAttributesResponse.itemId argument leads to overflow. The attack requires local access, and the exploit is public.

A heap-based buffer overflow vulnerability was found in MZ Automation libiec61850 up to 1.6.1 in the function SVReceiver_stopThreadless of src/sampled_values/sv_subscriber.c. The attack must be initiated locally and the exploit is public. Version 1.6.2 mitigates the issue.

Use-after-free vulnerability in MZ Automation libiec61850 up to 1.6.1, in the function deleteDataSetValuesShadowBuffer of the file src/iec61850/server/mms_mapping/reporting.c (URCB Revalidation component). The attack requires local access. The exploit has been made public. Upgrading to version 1.6.2 fixes the issue.

A weakness has been identified in mz-automation libiec61850 up to 1.6.1. The function checkDataSetAccess in src/iec61850/server/mms_mapping/mms_mapping.c causes an out-of-bounds read. The attack can be initiated remotely. The exploit has been made public.