Skip to content
OpenAdvisories
High ICSA-26-204-06 4 CVEs

MZ Automation libIEC61850

Published Jul 23, 2026 · Updated Jul 23, 2026

Vendor: MZ Automation Product: libIEC61850

Summary

Successful exploitation of these vulnerabilities could allow an unauthenticated network-adjacent attacker to crash critical IEC 61850 services or execute arbitrary code, disrupting or compromising protection, visibility, and control functions.

Vulnerabilities 4

  • High 8.1
    CVE-2026-49035

    Stack-based Buffer Overflow in MZ Automation libIEC61850

    The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is en…

    MZ Automation libIEC61850
  • High 7.5
    CVE-2026-50032

    NULL Pointer Dereference in MZ Automation libIEC61850

    A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field.

    MZ Automation libIEC61850
  • High 7.5
    CVE-2026-50039

    Stack-based Buffer Overflow in MZ Automation libIEC61850

    The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to cause a memory corruption via a Read Request.

    MZ Automation libIEC61850
  • Medium 6.5
    CVE-2026-50103

    Improper Handling of Syntactically Invalid Structure in MZ Automation libIEC61850

    A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value.

    MZ Automation libIEC61850

Revision history

  1. #1

    Initial Publication

References