Skip to content
OpenAdvisories
High ICSA-26-211-10 8 CVEs

MZ Automation GmbH libiec61850

Published Jul 30, 2026 · Updated Jul 30, 2026

Vendor: MZ Automation Product: libIEC61850

Summary

Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the device.

Vulnerabilities 8

  • High 7.5
    CVE-2026-66360

    MZ Automation libiec61850 Out-of-bounds Read

    The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of the encoded presentation data allows an attacker controlled field with a zero length value to trigger…

    MZ Automation libIEC61850
  • Medium 6.5
    CVE-2026-56758

    MZ Automation libiec61850 Out-of-bounds Read

    The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, an attacker controlled length value of zero or one may cause the parser to read past the end of a heap …

    MZ Automation libIEC61850
  • Medium 6.5
    CVE-2026-63550

    MZ Automation libiec61850 Out-of-bounds Read

    The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is received over an established MMS session (TCP port 102), the decoder may advance its internal re…

    MZ Automation libIEC61850
  • Medium 6.5
    CVE-2026-65421

    MZ Automation libiec61850 Out-of-bounds Read

    The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean/integer): an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-se…

    MZ Automation libIEC61850
  • Medium 6.5
    CVE-2026-66349

    MZ Automation libiec61850 Out-of-bounds Read

    The MMS server connection handler contains a flaw in its processing of BER-encoded request data. When an MMS confirmed request PDU containing an extended BER tag is received over an established session, the decoder may advance its internal buffer incorrectly …

    MZ Automation libIEC61850
  • Medium 6.5
    CVE-2026-66364

    MZ Automation libiec61850 Out-of-bounds Read

    The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. When processing specific payload fields, an attacker controlled inner element length may exceed its enclos…

    MZ Automation libIEC61850
  • Medium 6.5
    CVE-2026-66369

    MZ Automation libiec61850 Out-of-bounds Read

    The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus. When specific GOOSE message fields are processed, the parser advances its internal buffer position inc…

    MZ Automation libIEC61850
  • Medium 6.5
    CVE-2026-66720

    MZ Automation libiec61850 Out-of-bounds Read

    The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 multicast messages. A specially crafted GOOSE frame containing an undersized timestamp field can trigger a heap out-of-bo…

    MZ Automation libIEC61850

Revision history

  1. #1

    Initial Publication

References