# CVE-2026-63033: MZ Automation lib60870 out-of-bounds read in InformationObject_ParseObjectAddress

Source: https://junglewise.ai/threats/cve-2026-63033-mz-automation-lib60870-out-of-bounds-read-in-informationobject  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-63033 · Severity: medium · CVSS 6.5 · Published 2026-07-30

MZ Automation lib60870 is a software library used in industrial control systems to communicate using the IEC 60870-5-104 protocol, commonly found in energy and water utility sectors. A vulnerability in how the library handles specific network messages could allow an attacker to crash the device or potentially read small amounts of sensitive memory. This could lead to service disruptions in critical infrastructure operations.

Technologies: [MZ Automation Lib60870](https://junglewise.ai/threats/technologies/lib60870). Vendors: [MZ Automation](https://junglewise.ai/threats/vendors/mz-automation).

## Quick answers

**Is CVE-2026-63033 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63033 being exploited in the wild.

**How severe is CVE-2026-63033?** Medium severity, with a CVSS score of 6.5, published 30 July 2026.

**Which products and versions are affected?** MZ Automation Lib60870 2.4.0.

**Is there a fix for CVE-2026-63033?** A patch was published on 2026-07-30: Version 2.4.1 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63033 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-63033?** Check whether you run MZ Automation Lib60870 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read (CWE-125) exists in the InformationObject_ParseObjectAddress function within cs101_information_objects.c. The vulnerability is caused by a lack of bounds checking on the msgSize parameter when processing the Variable Structure Qualifier (VSQ) field in an IEC 60870-5-104 I-frame. If the declared object count exceeds the actual ASDU body size, the function reads one byte past the end of the heap-allocated message buffer. This can be exploited remotely over TCP port 2404 without authentication. The issue was identified via fuzzing and is addressed in version 2.4.1.

## Affected products

- MZ Automation lib60870 2.4.0

## Timeline

- 2026-06-05: advisory: Vendor advisory GHSA-7v97-jmwv-w5j7 published
- 2026-07-30: disclosed: CISA Advisory ICSA-26-211-11 published
- 2026-07-30: patched: Version 2.4.1 released to address the issue

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-11.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-11.json)
- [https://github.com/mz-automation/lib60870/security/advisories/GHSA-7v97-jmwv-w5j7](https://github.com/mz-automation/lib60870/security/advisories/GHSA-7v97-jmwv-w5j7)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-11](https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-11)

## Related threats

- [MZ Automation lib60870 out-of-bounds read in TestCommand_getFromBuffer](https://junglewise.ai/threats/cve-2026-61893-mz-automation-lib60870-out-of-bounds-read-in-testcommand)
- [MZ Automation lib60870 out-of-bounds read in parsing process](https://junglewise.ai/threats/cve-2026-16002-mz-automation-lib60870-out-of-bounds-read-in-parsing-process)
- [MZ Automation lib60870 heap buffer overflow in CS104 server](https://junglewise.ai/threats/cve-2026-51219-mz-automation-lib60870-heap-buffer-overflow-in-cs104-server)