Description
A vulnerability was found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function deleteDataSetValuesShadowBuffer of the file src/iec61850/server/mms_mapping/reporting.c of the component URCB Revalidation. The manipulation results in use after free. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 1.6.2 is sufficient to fix this issue. The patch is identified as 486fd57f3aed65bb9d636ff00f9ddce2e450b168. Upgrading the affected component is advised.
Published: 2026-08-06
Score: 4.8 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The function deleteDataSetValuesShadowBuffer in the URCB Revalidation component has a use‑after‑free bug that can be triggered locally. The improper handling of memory leads to corruption and may allow an attacker to execute arbitrary code, thereby compromising confidentiality, integrity, or availability of the system. The weakness is classified as CWE‑119 and CWE‑416.

Affected Systems

The vulnerability affects the MZ Automation libiec61850 library up to and including version 1.6.1. Upgrading to version 1.6.2 or later eliminates the problem, as the patch identified by commit 486fd57f3aed65bb9d636ff00f9ddce2e450b168 restores correct memory management in deleteDataSetValuesShadowBuffer.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. A public exploit and proof‑of‑concept are available, demonstrating that the issue can be exploited locally by an attacker with access to the affected component.

Generated by OpenCVE AI on August 6, 2026 at 23:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade libiec61850 to version 1.6.2 or later, which includes the fix for the use‑after‑free bug.
  • Apply the patch from commit 486fd57f3aed65bb9d636ff00f9ddce2e450b168 to eliminate the accidental memory deallocation if an upgrade cannot be performed immediately.
  • Restrict local execution of the library or service that accesses the URCB Revalidation component to trusted users only, reducing the attack surface for local exploitation.

Generated by OpenCVE AI on August 6, 2026 at 23:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 06 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function deleteDataSetValuesShadowBuffer of the file src/iec61850/server/mms_mapping/reporting.c of the component URCB Revalidation. The manipulation results in use after free. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 1.6.2 is sufficient to fix this issue. The patch is identified as 486fd57f3aed65bb9d636ff00f9ddce2e450b168. Upgrading the affected component is advised.
Title MZ Automation libiec61850 URCB Revalidation reporting.c deleteDataSetValuesShadowBuffer use after free
First Time appeared Mz Automation
Mz Automation libiec61850
Weaknesses CWE-119
CWE-416
CPEs cpe:2.3:a:mz_automation:libiec61850:*:*:*:*:*:*:*:*
Vendors & Products Mz Automation
Mz Automation libiec61850
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Mz Automation Libiec61850
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-06T20:30:14.200Z

Reserved: 2026-08-06T13:58:41.401Z

Link: CVE-2026-19108

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-06T23:45:03Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-416

    Use After Free