A vulnerability in libIEC61850 allows an unauthenticated client to request a file with an out‑of‑range initialPosition. The server stores this value, later subtracts it from the file size using unsigned arithmetic, and fails to trim the response to the actual read size. The oversized reply can contain stale bytes from a reused connection buffer, leaking data from previous protocol exchanges. This presents a medium‑high confidentiality risk under CWE‑200, with underlying issues in unsigned arithmetic (CWE‑191) and potential overflow conditions (CWE‑252).

The issue exists in the mz‑automation libiec61850 implementation before version 1.6.2. The library is an open‑source IEC 61850 stack used for MMS, GOOSE, Sampled Values, and R‑Session handling. Any deployment that compiles or links with libiec61850 prior to the 1.6.2 release is potentially affected.

The CVSS score of 7.5 indicates a medium‑to‑high severity, but the EPSS score is not reported, so current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, and no public exploits have been released. The attack requires only that the MMS file service be enabled; an attacker can trivially interact with the service from any network location, making the risk significant for exposed servers that enable file read operations.