The vulnerability arises from an out‑of‑bounds stack read caused by reversed arguments to StringUtils_copyStringToBuffer during MMS_ASSOCIATION_SPECIFIC dataset reference construction. The helper accesses uninitialized data in dataSetRef[130] as a source string, triggering a strlen overrun and copying the garbage bytes into the caller‑owned listName buffer. This flaw, a CWE‑125 out‑of‑bounds read combined with CWE‑457 use‑after‑uninitialization, can lead to stack corruption and a server crash, delivering a denial of service to the IEC 61850 server.

All users of mz‑automation libIEC61850 before version 1.6.2 are vulnerable, but the flaw is exercised only when the dynamic dataset service is enabled and a dataset access handler is installed on the server. Systems that expose IEC 61850 through the defineNamedVariableList interface and receive externally supplied requests from the network are at risk. Industrial control or substation automation environments deploying earlier releases should verify whether these features are active and, if so, consider mitigation.

The flaw scores 8.2 on the CVSS base, placing it in the high‑severity range. The EPSS score is not publicly available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation. An attacker can trigger the crash by sending a malformed defineNamedVariableList message over the IEC 61850 port, so the attack vector is remote network. Given the high CVSS rating, the lack of mitigation in many deployments, and the potential for disruptive downtime, this vulnerability warrants immediate attention.