Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-66349 EUVD-2026-51340GHSA-8m3p-4g59-6h2r

MZ Automation libiec61850 Out-of-bounds Read

Published Jul 30, 2026 · Updated Jul 31, 2026 · Assigned by icscert

Description

The MMS server connection handler contains a flaw in its processing of
BER-encoded request data. When an MMS confirmed request PDU containing
an extended BER tag is received over an established session, the decoder
may advance its internal buffer incorrectly due to a missing bounds
check. This results in a one byte heap out-of-bounds read and causes the
MMS service process to terminate, leading to a denial-of-service
condition.

Affected products

VendorProductAffectedFixed
MZ Automation libiec61850 < 1.6.2 1.6.2

Advisories 1

References