SB2026061835 - Multiple vulnerabilities in libIEC61850

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026061835

SB2026061835 - Multiple vulnerabilities in libIEC61850

Published: June 18, 2026 Updated: July 7, 2026

Security Bulletin ID SB2026061835
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 88% Low 13%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) NULL pointer dereference (CVE-ID: CVE-2026-48741)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in alternateArrayAccess() in the MMS read service when processing out-of-range sub-array read requests using alternate-access indexRange. A remote attacker can send a specially crafted MMS Read request to cause a denial of service.

Only MMS server implementations that use data models containing arrays are vulnerable.


2) Integer underflow (CVE-ID: CVE-2026-48503)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to integer underflow in the MMS file service when processing a fileOpen request with an out-of-range initialPosition followed by fileRead. A remote attacker can send crafted MMS file service requests to disclose sensitive information.

The disclosed data can include stale bytes from a previous fileRead response on the same connection, protocol fragments, and residual data left in the connection send buffer.


3) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the SV subscriber getter functions when processing a malformed Sampled Values frame with a fixed-width field encoded with an invalid shorter length. A remote attacker can send a specially crafted SV frame to cause a denial of service.

The issue is reachable from the normal subscriber callback path and can be triggered on the same Layer-2 network segment as the subscriber.


4) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in parseUserInformation() when parsing a malformed ACSE AARE PDU during MMS / IEC 61850 association handling. A remote attacker can send a specially crafted AARE PDU to cause a denial of service.

The issue is reachable before authentication.


5) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in parseUserInformation() when parsing a malformed ACSE AARE PDU during MMS / IEC 61850 association handling. A remote attacker can send a specially crafted AARE PDU to disclose sensitive information.

The out-of-bounds read is a 1-byte heap read and is reachable before authentication.


6) Free of Memory not on the Heap (CVE-ID: N/A)

CWE-ID: CWE-590 - Free of Memory not on the Heap

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to free of memory not on the heap in sendNextReportEntrySegment when processing an oversized RptID during report sending after reporting is enabled with GI. A remote attacker can write an oversized RptID to a report control block and trigger report generation to cause a denial of service.

The issue is triggered after the server accepts the RptID write and later serializes the value in the report send path using a stack-backed visible string.


7) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in checkDataSetAccess when handling association-specific dynamic dataset creation requests. A remote attacker can send a specially crafted defineNamedVariableList request to cause a denial of service.

Only instances with dynamic dataset service enabled and a dataset access handler installed are vulnerable.


8) Double free (CVE-ID: CVE-2026-57446)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to double free in the MMS ObtainFile task handling when processing a sequence of ObtainFile requests that reuses a stale FILE* handle. A remote attacker can send crafted ObtainFile requests to cause a denial of service.

Only servers with MMS file service and MMS ObtainFile enabled are vulnerable. Exploitation requires a successful ObtainFile request to leave a stale file handle in a reusable task before a later ObtainFile request triggers destination-error cleanup.


Remediation

Install update from vendor's website.

References