CVE-2026-48503
Received Received - Intake

MMS File Service Information Disclosure in libIEC61850

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, the MMS file service in src/mms/iso_mms/server/mms_file_service.c accepts an out-of-range initialPosition in fileOpen and stores it in the file-read state. The fileRead path then subtracts the larger read position from the file size using unsigned arithmetic and fails to limit the response to the actual FileSystem_readFile return value. The oversized response can include stale bytes from the reused connection buffer after the requested file contents, disclosing prior response data and protocol fragments to an unauthenticated remote client when the file service is enabled. This issue is fixed in version 1.6.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-48503
EUVD
EUVD-2026-102907

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mz-automation libiec61850 < 1.6.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-252 The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-191 The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a remote information disclosure flaw in the libIEC61850 library affecting versions 1.6.1 and older. It occurs in the MMS file service when an unauthenticated remote client sends an out-of-range initialPosition value to the fileOpen function. The server then returns a payload larger than the actual file size due to unvalidated input, unsigned integer underflow, and buffer reuse, exposing stale data from previous responses or connection buffers.

Detection Guidance

To detect this vulnerability, check if your libIEC61850 version is below 1.6.2. Use commands like 'pkg-config --modversion libiec61850' or inspect version in application logs. Monitor network traffic for MMS file service requests with unusually large responses.

Impact Analysis

An attacker could exploit this to read sensitive data from memory buffers, including protocol fragments or residual content from prior file reads on the same connection. This could lead to unauthorized access to confidential information without requiring privileges or user interaction.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive data, which may violate GDPR's data protection principles (e.g., integrity and confidentiality) and HIPAA's security rule requirements for protecting electronic protected health information. Unpatched systems risk exposing residual data from prior operations, potentially including personal or health-related information.

Mitigation Strategies

Immediately upgrade libIEC61850 to version 1.6.2 or later. If upgrading is not possible, apply the patch from commit bba5bf2 manually. Disable the MMS file service if not required. Monitor for unusual network activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48503. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart