CVE-2026-66349

MZ Automation libiec61850 Out-of-bounds Read

Published Jul 30, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

The MMS server connection handler contains a flaw in its processing of
BER-encoded request data. When an MMS confirmed request PDU containing
an extended BER tag is received over an established session, the decoder
may advance its internal buffer incorrectly due to a missing bounds
check. This results in a one byte heap out-of-bounds read and causes the
MMS service process to terminate, leading to a denial-of-service
condition.

Analysis

Technical impact

The vulnerability arises when the MMS server processes a confirmed request PDU that contains an extended BER tag. The decoder, missing a bounds check, may advance its internal buffer incorrectly, resulting in a one‑byte out‑of‑bounds read on the heap. This triggers a crash of the MMS service process, causing the component to terminate and creating a denial‑of‑service condition for the affected system.

Affected Systems

MZ Automation GmbH’s libiec61850 library is affected. All releases prior to version 1.6.2 are vulnerable, as identified by the vendor. The fix is included in libiec61850 1.6.2.

Risk and Exploitability

The flaw can be exploited by an attacker who can send a crafted MMS confirmed request over an established IEC 61850 session. The EPSS score for this vulnerability is 0.00181 (i.e., <1%), and it is not listed in CISA KEV. The CVSS score of 6.9 indicates a moderate severity. The attack vector is likely remote over the network, requiring network access to the MMS service, and would result in a denial of service rather than data compromise.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

MZ Automation GmbH

libiec61850

unaffected

Version	Status	Constraints
`0`	affected	< 1.6.2
`1.6.2`	unaffected	—

No data.

Vendor Product Versions

Mz-automation

Libiec61850

Version	Status	Scheme	Platform
`[0,1.6.2)`	affected	generic	—
`1.6.2`	unaffected	semver	—

Remediation

Vendor Solution

MZ Automation GmbH recommends that users update to version 1.6.2.

OpenCVE Recommended Actions

Upgrade libiec61850 to version 1.6.2 or later as recommended by MZ Automation.
If the update cannot be applied immediately, filter or block incoming MMS traffic that contains extended BER tags to prevent malformed packets from reaching the server.
Continuously monitor MMS service logs for repeated crashes and consider disabling the MMS functionality if it is not required for operation.

Generated by OpenCVE AI on August 3, 2026 at 10:22 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.295% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-10.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10

History

Aug 3, 2026 4:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mz-automation Mz-automation libiec61850
Vendors & Products		Mz-automation Mz-automation libiec61850

Jul 31, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 30, 2026 10:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The MMS server connection handler contains a flaw in its processing of BER-encoded request data. When an MMS confirmed request PDU containing an extended BER tag is received over an established session, the decoder may advance its internal buffer incorrectly due to a missing bounds check. This results in a one byte heap out-of-bounds read and causes the MMS service process to terminate, leading to a denial-of-service condition.
Title		MZ Automation libiec61850 Out-of-bounds Read
Weaknesses		CWE-125
References		https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-10.json https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`