Description
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path therefore swallows the error, reads buffer[-1], resets parsing to the beginning, and repeats the same malformed state. An unauthenticated remote peer can send a malformed AARE PDU during association to cause an infinite CPU loop under a normal allocator or a one-byte out-of-bounds read and process abort when the preceding byte is inaccessible. This issue is fixed in version 1.6.2.
Published: 2026-10-16
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (resource exhaustion or crash)
Action: Immediate Patch
AI Analysis

Impact

An attacker can send a malformed AARE PDU during an IEC 61850 MMS association to trigger a bug in libIEC61850’s ACSE parsing code. The bug allows an unauthenticated remote peer to cause an infinite CPU loop or to read past the allocated buffer before the process aborts. These behaviors lead to service unavailability, either by exhausting processor resources or by crashing the application.

Affected Systems

The vulnerability affects the mz-automation libIEC61850 library, any software that incorporates this library for IEC 61850 protocol support, and any versions older than 1.6.2. Applications using the default build of libIEC61850 before the 1.6.2 release are susceptible.

Risk and Exploitability

With a CVSS score of 8.7 this vulnerability is classified as high severity. EPSS data is not available and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is a remote, unauthenticated network connection that transmits a crafted AARE PDU during association, which requires no authentication and can be performed from any host that can reach the target over the MMS port. Exploitation can result in a denial‑of‑service condition caused by either an endless loop or a process termination due to an out‑of‑bounds read.

Generated by OpenCVE AI on October 16, 2026 at 19:43 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade libIEC61850 to version 1.6.2 or later.
  • Configure network controls to allow MMS association only from trusted hosts, using firewalls or VLAN segmentation.
  • Monitor the application for abnormal CPU usage or crash events that could indicate an exploitation attempt.

Generated by OpenCVE AI on October 16, 2026 at 19:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Mz-automation
Mz-automation libiec61850
Vendors & Products Mz-automation
Mz-automation libiec61850

Fri, 16 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path therefore swallows the error, reads buffer[-1], resets parsing to the beginning, and repeats the same malformed state. An unauthenticated remote peer can send a malformed AARE PDU during association to cause an infinite CPU loop under a normal allocator or a one-byte out-of-bounds read and process abort when the preceding byte is inaccessible. This issue is fixed in version 1.6.2.
Title libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDU
Weaknesses CWE-125
CWE-835
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Mz-automation Libiec61850
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-16T15:49:32.595Z

Reserved: 2026-07-31T21:04:04.040Z

Link: CVE-2026-68906

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-16T16:20:00.793

Modified: 2026-10-16T20:04:29.760

Link: CVE-2026-68906

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T19:15:13Z

Weaknesses
  • CWE-125

    Out-of-bounds Read

  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')