Executive brief
A vulnerability exists in a widely used communication library for electrical substation automation. An attacker on the same local network can send a specially crafted message to a device using this library, causing the system to crash. This results in a denial-of-service, potentially disrupting critical infrastructure operations and monitoring.
Technical details
The MMS server connection handler in libiec61850 (versions prior to 1.6.2) contains a flaw in its BER-encoded request data processing. When an MMS confirmed request PDU containing an extended BER tag is received over an established session, the decoder fails to perform a proper bounds check. This missing check causes the decoder to advance its internal buffer incorrectly, resulting in a one-byte heap out-of-bounds read. An attacker with adjacent network access can exploit this to terminate the MMS service process, causing a denial-of-service (DoS) condition. The issue is addressed in version 1.6.2.
Affected products
- MZ Automation GmbH libiec61850 < 1.6.2
Timeline
- 2026-07-30: disclosed
- 2026-07-30: advisory