Is CVE-2026-66349 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66349 being exploited in the wild.

How severe is CVE-2026-66349?

Medium severity, with a CVSS score of 6.5, published 30 July 2026.

Which products and versions are affected?

MZ Automation GmbH libiec61850 < 1.6.2.

Is there a fix for CVE-2026-66349?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-66349 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-66349?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66349: MZ Automation libiec61850 heap out-of-bounds read in MMS server

Q: Is there a fix for CVE-2026-66349?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-66349 attacked?

It is attacked from the adjacent network, in a software library.

Q: Am I affected by CVE-2026-66349?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66349 · Severity: medium · CVSS 6.5 · Published 2026-07-30

A vulnerability exists in a widely used communication library for electrical substation automation. An attacker on the same local network can send a specially crafted message to a device using this library, causing the system to crash. This results in a denial-of-service, potentially disrupting critical infrastructure operations and monitoring.

Quick answers

Is CVE-2026-66349 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66349 being exploited in the wild.
How severe is CVE-2026-66349?: Medium severity, with a CVSS score of 6.5, published 30 July 2026.
Which products and versions are affected?: MZ Automation GmbH libiec61850 < 1.6.2.
Is there a fix for CVE-2026-66349?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-66349 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-66349?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The MMS server connection handler in libiec61850 (versions prior to 1.6.2) contains a flaw in its BER-encoded request data processing. When an MMS confirmed request PDU containing an extended BER tag is received over an established session, the decoder fails to perform a proper bounds check. This missing check causes the decoder to advance its internal buffer incorrectly, resulting in a one-byte heap out-of-bounds read. An attacker with adjacent network access can exploit this to terminate the MMS service process, causing a denial-of-service (DoS) condition. The issue is addressed in version 1.6.2.

Affected products

MZ Automation GmbH libiec61850 < 1.6.2

Timeline

2026-07-30: disclosed
2026-07-30: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.