Description
A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an
inflated object count causes TestCommand_getFromBuffer to read one byte
past the end of the heap-allocated message buffer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MZ Automation | lib60870 | 2.4.0 | 2.4.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | lib60870 | No fix yet | — |
| Ubuntu 26.04 LTS | lib60870 | No fix yet | — |
Advisories 1
- ICSA-26-211-11 MZ Automation lib60870 CISA ICS & IT advisories · Jul 30, 2026