Description
A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiver_stopThreadless of the file src/sampled_values/sv_subscriber.c of the component ASDU Element Handler. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.2 is able to mitigate this issue. The patch is named a96bd674e0238276dd1387d31d52e55229d0771e. The affected component should be upgraded.
Published: 2026-08-07
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A local heap-based buffer overflow was found in the SVReceiver_stopThreadless function of the ASDU Element Handler in libiec61850. The overflow occurs when malicious input is processed in sv_subscriber.c, potentially corrupting dynamic memory. This weakness corresponds to CWE‑119 and CWE‑122 and can lead to application crashes or, if code is injected, arbitrary local code execution.

Affected Systems

MZ Automation’s libiec61850 library, versions up to and including 1.6.1, is affected. The flaw resides in the sampled‑values component. Version 1.6.2 contains the bug fix and is not vulnerable.

Risk and Exploitability

The CVSS score of 4.8 classifies the issue as moderate severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Because the attack vector is local, exploitation requires physical or network-level local access to the device or system running libiec61850. Public exploits have been released, so an attacker with local privileges can potentially crash or take over the affected component.

Generated by OpenCVE AI on August 7, 2026 at 15:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade libiec61850 to version 1.6.2, which includes the fixing patch
  • Replace the vulnerable library in all affected applications with the patched version
  • Restart or reload the application to ensure the updated library is in use

Generated by OpenCVE AI on August 7, 2026 at 15:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 07 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Mz-automation
Mz-automation libiec61850
Vendors & Products Mz-automation
Mz-automation libiec61850

Fri, 07 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 07 Aug 2026 14:15:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiver_stopThreadless of the file src/sampled_values/sv_subscriber.c of the component ASDU Element Handler. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.2 is able to mitigate this issue. The patch is named a96bd674e0238276dd1387d31d52e55229d0771e. The affected component should be upgraded.
Title MZ Automation libiec61850 ASDU Element sv_subscriber.c SVReceiver_stopThreadless heap-based overflow
First Time appeared Mz Automation
Mz Automation libiec61850
Weaknesses CWE-119
CWE-122
CPEs cpe:2.3:a:mz_automation:libiec61850:*:*:*:*:*:*:*:*
Vendors & Products Mz Automation
Mz Automation libiec61850
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Mz-automation Libiec61850
Mz Automation Libiec61850
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-07T14:24:02.477Z

Reserved: 2026-08-07T08:08:58.628Z

Link: CVE-2026-19206

cve-icon Vulnrichment

Updated: 2026-08-07T14:22:35.721Z

cve-icon NVD

Status : Deferred

Published: 2026-08-07T14:16:59.020

Modified: 2026-08-12T21:00:37.147

Link: CVE-2026-19206

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-07T15:30:04Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-122

    Heap-based Buffer Overflow