Executive brief
libiec61850 is an open-source library implementing the IEC 61850 industrial control protocols used in electrical substations and grid systems. An oversized report ID parameter causes the server to attempt to free stack memory instead of heap memory, crashing the server. An attacker with network access can remotely trigger a denial of service by sending a specially crafted report control block write request.
Technical details
The vulnerability is a use-after-free / invalid free (CWE-590) in the report sending path. The affected function Reporting_RCBWriteAccessHandler and sendNextReportEntrySegment in reporting.c allocate a fixed 130-byte stack buffer (rptIdBuf) and wrap it as a temporary MmsValue visible string. When a client writes an oversized RptID exceeding this capacity, subsequent calls to MmsValue_setVisibleString attempt to resize and free the buffer, which points to stack memory rather than heap-allocated memory. This causes a segmentation fault and server crash. Attack preconditions require network reachability to the MMS/IEC 61850 server port and the ability to write to a report control block, then enable reporting via a GI (General Interrogation) request. No authentication bypass is required if the server allows unauthenticated reporting control. The fix (patch 5b2a69f44256b8548927d8afdd7ac5f5381abe1e) is available in version 1.6.2.
Affected products
- mz-automation libiec61850 up to 1.6.1
Timeline
- 2026-08-03: disclosed
- 2026-08-03: patched: Fix available in version 1.6.2 (patch 5b2a69f44256b8548927d8afdd7ac5f5381abe1e)