CVE-2026-18583
Received Received - Intake

Out-of-Bounds Read in libiec61850 MMS Request Handler

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulDB

Description
A weakness has been identified in mz-automation libiec61850 up to 1.6.1. This issue affects the function checkDataSetAccess of the file src/iec61850/server/mms_mapping/mms_mapping.c of the component MMS Request Handler. This manipulation causes out-of-bounds read. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.6.2 is capable of addressing this issue. Patch name: 062062daf4cb50c7aa76e01d6fb4d58fc9278a7d. Upgrading the affected component is recommended. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-18583
EUVD
EUVD-2026-52152

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mz-automation libiec61850 to 1.6.1 (inc)
mz-automation libiec61850 1.6.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read issue in the mz-automation libiec61850 library up to version 1.6.1. It affects the function checkDataSetAccess in the MMS Request Handler component. The flaw allows remote attackers to manipulate data, causing the program to read memory outside its intended boundaries.

Detection Guidance

Detecting this vulnerability requires checking the version of mz-automation libiec61850 installed on your system. If you are running a version up to 1.6.1, the system is vulnerable. Use commands like 'dpkg -l | grep libiec61850' on Debian-based systems or 'rpm -qa | grep libiec61850' on RPM-based systems to check the installed version.

Impact Analysis

An attacker could exploit this to cause crashes, data corruption, or potentially access sensitive information. Since the attack can be initiated remotely, systems using the vulnerable library are at risk without proper patching.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves an out-of-bounds read in a specific industrial protocol library (libiec61850). However, if exploited, it could lead to unauthorized data access or system disruption, potentially impacting data integrity or availability, which are key considerations under these regulations.

Mitigation Strategies

Upgrade the mz-automation libiec61850 component to version 1.6.2 or later to address the out-of-bounds read vulnerability in the MMS Request Handler.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18583. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart