A flaw in mz-automation libiec61850 allows a remote attacker to craft an MMS request that triggers an out-of-bounds read in the function checkDataSetAccess. The vulnerability is a classic buffer over-read (CWE‑125) that can expose sensitive data in memory and may serve as a foothold for further exploitation. The vulnerability is not mitigated by input authentication alone, and the exploit code is publicly available.

The issue exists in all releases of mz-automation libiec61850 up to and including version 1.6.1. Users of the library in any product that incorporates these versions are affected. The fix is delivered in release 1.6.2 and later, which incorporates commit 062062daf4cb50c7aa76e01d6fb4d58fc9278a7d. No other vendors or product variants are listed as impacted.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is not available, leaving the precise likelihood of exploitation uncertain. The vulnerability is not in the CISA KEV catalog, but the presence of publicly released exploit code demonstrates that attackers can target it remotely. Without remediation, affected systems face a moderate risk of data exposure and potential escalation. Grounded in the described out-of-bounds read, the attack surface is remote and does not require local privileges.