A double free caused by a stale FILE* pointer in the MMS ObtainFile process can crash the server. The flaw arises when an ObtainFile task is reused after a failed file destination creation, leading to the same FILE object being closed twice. The resulting crash is limited to denial of service; no code execution or data disclosure is directly exposed by the issue.

mz-automation libiec61850 versions 1.6.1 through 1.6.2, with the vulnerability present in all releases prior to 1.6.2. Any deployment of these versions that exposes an MMS file service and allows ObtainFile requests is susceptible.

The CVSS base score of 5.3 indicates a moderate impact. EPSS information is unavailable, and the vulnerability is not listed in CISA KEV, suggesting the likelihood of real-world exploitation is low at present. However, the attack requires only a remote MMS ObtainFile request, which is feasible over the network to the server’s MMS port. For environments that rely on MMS obtain file functionality, the risk remains that an attacker could induce a server crash by sending a success‑then‑failure sequence.