CVE-2026-19206
Received Received - Intake

Heap-based Buffer Overflow in libiec61850

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: VulDB

Description
A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiver_stopThreadless of the file src/sampled_values/sv_subscriber.c of the component ASDU Element Handler. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.2 is able to mitigate this issue. The patch is named a96bd674e0238276dd1387d31d52e55229d0771e. The affected component should be upgraded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-19206
EUVD
EUVD-2026-54486

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mz_automation libiec61850 to 1.6.2 (exc)
mz_automation libiec61850 1.6.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19206 is an out-of-bounds read vulnerability in the libiec61850 library affecting versions up to 1.6.1. It occurs in the Sampled Values (SV) subscriber path when handling the confRev field. A malformed SV frame with a BER-encoded confRev element of length 1 can trigger a heap-buffer-overflow when the library's public getter unconditionally reads 4 bytes from the field. The vulnerability arises because the parser accepts any BER-legal length during parsing but the getter assumes a fixed 4-byte width.

Detection Guidance

Detecting this vulnerability requires checking the version of libiec61850 installed on your system. Use commands like 'pkg-config --modversion libiec61850' or inspect the library files directly. Monitor network traffic for malformed SV frames with unusual confRev field lengths, especially near buffer boundaries. Check system logs for subscriber crashes or memory corruption errors.

Impact Analysis

An attacker on the same Layer-2 network can exploit this to cause a denial of service via subscriber process crash. The flaw is reachable through normal SV protocol processing and can be reproduced using the official example.

Compliance Impact

This vulnerability is a heap-based buffer overflow in the libiec61850 library, which could lead to denial of service or memory corruption. While it does not directly impact data privacy or confidentiality, compliance with standards like GDPR or HIPAA could be indirectly affected if the vulnerability causes system failures or disruptions in critical infrastructure that processes personal or sensitive data.

Mitigation Strategies

Upgrade libiec61850 to version 1.6.2 immediately using your package manager or by compiling from the official release. Apply the patch commit a96bd674e0238276dd1387d31d52e55229d0771e if upgrading is not feasible. Isolate affected systems on the same Layer-2 network to limit attack surface until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19206. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart