The libiec61850 MMS BER decoder contains a boundary‑handling flaw in the processing of confirmed‑request messages. When a crafted BER‑encoded element is received over an established MMS session on TCP port 102, the decoder may advance its internal read pointer incorrectly, causing a heap out‑of‑bounds read that terminates the MMS handling process and results in a denial of service.

MZ Automation GmbH’s libiec61850 library is affected. The vulnerability exists in versions prior to 1.6.2, which users should update to the latest release that addresses the issue. Devices running libiec61850 that accept MMS traffic on TCP port 102 are particularly at risk.

The CVSS base score of 7.1 indicates a high impact of the crash, while the EPSS score of 0.25% shows a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation data. The likely attack vector is remote, as an attacker must be able to send a crafted BER message to a device over the MMS session on port 102. No publicly known exploits have been disclosed, but the severity warrants proactive mitigation.