Is CVE-2026-18582 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18582 being exploited in the wild.

How severe is CVE-2026-18582?

Medium severity, with a CVSS score of 5.3, published 3 August 2026.

Which products and versions are affected?

MZ Automation libIEC61850 up to 1.6.1.

Is there a fix for CVE-2026-18582?

A patch was published on 2026-08-03: Fix available in version 1.6.2 (patch 5b2a69f44256b8548927d8afdd7ac5f5381abe1e) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-18582 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-18582?

Check whether you run MZ Automation libIEC61850 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18582: mz-automation libiec61850 invalid free in report handling

CVE-2026-18582 · Severity: medium · CVSS 5.3 · Published 2026-08-03

libiec61850 is an open-source library implementing the IEC 61850 industrial control protocols used in electrical substations and grid systems. An oversized report ID parameter causes the server to attempt to free stack memory instead of heap memory, crashing the server. An attacker with network access can remotely trigger a denial of service by sending a specially crafted report control block write request.

Technologies: MZ Automation libIEC61850. Vendors: MZ Automation.

Quick answers

Is CVE-2026-18582 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18582 being exploited in the wild.
How severe is CVE-2026-18582?: Medium severity, with a CVSS score of 5.3, published 3 August 2026.
Which products and versions are affected?: MZ Automation libIEC61850 up to 1.6.1.
Is there a fix for CVE-2026-18582?: A patch was published on 2026-08-03: Fix available in version 1.6.2 (patch 5b2a69f44256b8548927d8afdd7ac5f5381abe1e) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-18582 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-18582?: Check whether you run MZ Automation libIEC61850 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a use-after-free / invalid free (CWE-590) in the report sending path. The affected function Reporting_RCBWriteAccessHandler and sendNextReportEntrySegment in reporting.c allocate a fixed 130-byte stack buffer (rptIdBuf) and wrap it as a temporary MmsValue visible string. When a client writes an oversized RptID exceeding this capacity, subsequent calls to MmsValue_setVisibleString attempt to resize and free the buffer, which points to stack memory rather than heap-allocated memory. This causes a segmentation fault and server crash. Attack preconditions require network reachability to the MMS/IEC 61850 server port and the ability to write to a report control block, then enable reporting via a GI (General Interrogation) request. No authentication bypass is required if the server allows unauthenticated reporting control. The fix (patch 5b2a69f44256b8548927d8afdd7ac5f5381abe1e) is available in version 1.6.2.

Affected products

mz-automation libiec61850 up to 1.6.1

Timeline

2026-08-03: disclosed
2026-08-03: patched: Fix available in version 1.6.2 (patch 5b2a69f44256b8548927d8afdd7ac5f5381abe1e)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.