Description
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValue_getElement call returns NULL, and the sub-array branch passes that value to MmsValue_isDeletable, causing a NULL pointer dereference. A remote MMS Read request can therefore crash servers whose data models contain arrays, while the single-element error path handles the same invalid index safely. This issue is fixed in version 1.6.2.
Published: 2026-10-16
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Remote Denial‑of‑Service
Action: Apply Patch
AI Analysis

Impact

The vulnerability arises from an out‑of‑range check missing in the MMS Read alternate‑array handling code. A malicious MMS Read request can cause a NULL pointer dereference during the request processing, leading to an abrupt server crash. This crash results in a denial‑of‑service that can be triggered by any remote client able to send MMS requests to the affected server.

Affected Systems

The flaw exists in mz‑automation's libiec61850 library, versions prior to 1.6.2. Servers that use this library and expose MMS services, particularly those whose data models contain array elements, are susceptible.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity. EPSS is not available and the flaw is not listed in KEV. The likely attack vector is a remote MMS client that can craft an alternate‑array access request. Successful exploitation will crash the server and suspend MMS services, but the vulnerability does not provide escalation or persistence beyond the denial‑of‑service effect.

Generated by OpenCVE AI on October 16, 2026 at 18:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade libiec61850 to version 1.6.2 or later to apply the out‑of‑range validation fix.
  • Disable or restrict MMS Read operations that use alternate‑array access until the patch is deployed, and restrict access to trusted clients only.
  • Apply network segmentation or firewall rules to limit MMS traffic to protected, authenticated clients, thereby reducing exposure while remediation is in progress.

Generated by OpenCVE AI on October 16, 2026 at 18:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValue_getElement call returns NULL, and the sub-array branch passes that value to MmsValue_isDeletable, causing a NULL pointer dereference. A remote MMS Read request can therefore crash servers whose data models contain arrays, while the single-element error path handles the same invalid index safely. This issue is fixed in version 1.6.2.
Title libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoS
Weaknesses CWE-129
CWE-252
CWE-476
CWE-754
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-16T15:45:32.680Z

Reserved: 2026-05-22T19:10:35.747Z

Link: CVE-2026-48741

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-16T16:18:11.943

Modified: 2026-10-16T20:04:29.760

Link: CVE-2026-48741

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T18:30:14Z

Weaknesses
  • CWE-129

    Improper Validation of Array Index

  • CWE-252

    Unchecked Return Value

  • CWE-476

    NULL Pointer Dereference

  • CWE-754

    Improper Check for Unusual or Exceptional Conditions