Description
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, Reporting_RCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes sendNextReportEntrySegment to serialize the report, the function wraps rptIdBuf[130] as a temporary MmsValue and passes it to MmsValue_setVisibleString. The setter's resize path frees the stack-backed buffer, allowing a remote client to trigger an invalid free and server crash by writing the oversized RptID and then generating a report. This issue is fixed in version 1.6.2.
Published: 2026-10-16
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service via server crash
Action: Patch
AI Analysis

Impact

The library’s serialization routine frees a stack‑backed buffer when handling an RptID greater than 129 bytes, causing a server crash. Based on the description, this likely represents a stack‑based buffer misuse (CWE‑590, CWE‑664, CWE‑763).

Affected Systems

The issue affects the open‑source IEC 61850 implementation libIEC61850 from mz‑automation. All releases before version 1.6.2 are vulnerable. Upgrading to v1.6.2 or later removes the bug.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, so the likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. The likely remote attack vector is that an attacker sends a report‑control‑block write with an oversized RptID and then triggers a report generation to exploit the flaw.

Generated by OpenCVE AI on October 16, 2026 at 19:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade libIEC61850 to version 1.6.2 or newer.
  • Recompile and restart any applications that link to the library to ensure the updated build is loaded.
  • Apply a patch that enforces an RptID length limit of 129 bytes before serialization to prevent accidental freeing of stack memory.

Generated by OpenCVE AI on October 16, 2026 at 19:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, Reporting_RCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes sendNextReportEntrySegment to serialize the report, the function wraps rptIdBuf[130] as a temporary MmsValue and passes it to MmsValue_setVisibleString. The setter's resize path frees the stack-backed buffer, allowing a remote client to trigger an invalid free and server crash by writing the oversized RptID and then generating a report. This issue is fixed in version 1.6.2.
Title libIEC61850: Oversized RptID can trigger invalid free of a stack-backed visible string in the report send path
Weaknesses CWE-590
CWE-664
CWE-763
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-16T16:51:44.888Z

Reserved: 2026-07-31T21:04:04.040Z

Link: CVE-2026-68908

cve-icon Vulnrichment

Updated: 2026-10-16T16:51:39.245Z

cve-icon NVD

Status : Deferred

Published: 2026-10-16T16:20:01.140

Modified: 2026-10-16T20:04:29.760

Link: CVE-2026-68908

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T19:45:14Z

Weaknesses
  • CWE-590

    Free of Memory not on the Heap

  • CWE-664

    Improper Control of a Resource Through its Lifetime

  • CWE-763

    Release of Invalid Pointer or Reference