CVE-2026-48741
Received Received - Intake

MMS Array Access Null Pointer Dereference in libIEC61850

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValue_getElement call returns NULL, and the sub-array branch passes that value to MmsValue_isDeletable, causing a NULL pointer dereference. A remote MMS Read request can therefore crash servers whose data models contain arrays, while the single-element error path handles the same invalid index safely. This issue is fixed in version 1.6.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-48741
EUVD
EUVD-2026-102908

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mz-automation libiec61850 < 1.6.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
CWE-252 The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CWE-754 The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48741 is a high-severity vulnerability in libIEC61850 v1.6.1 that allows a remote attacker to cause a server-side denial of service (DoS) through a NULL pointer dereference. The issue occurs in the MMS Read handling path for array alternate-access operations. When processing out-of-range array indices, the code inconsistently handles single-element access versus sub-array access, leading to a crash.

Detection Guidance

To detect this vulnerability, monitor for crashes in libIEC61850-based MMS servers when processing array alternate-access requests. Check server logs for NULL pointer dereference errors or segmentation faults during MMS Read operations. Inspect network traffic for malformed MMS packets targeting array indices.

Impact Analysis

A remote client can crash the server by sending an MMS Read request with an out-of-range sub-array index. This impacts server availability, potentially disrupting operations dependent on the IEC 61850 protocol, such as industrial control systems or smart grid applications.

Compliance Impact

This vulnerability primarily impacts system availability by causing denial-of-service conditions through server crashes. It does not directly affect data confidentiality or integrity, which are key focus areas for GDPR and HIPAA. However, prolonged downtime could indirectly impact compliance by disrupting access to critical systems handling personal or health data.

Mitigation Strategies

Upgrade libIEC61850 to version 1.6.2 or later. If upgrading is not immediately possible, restrict network access to MMS servers containing arrays or implement deep packet inspection to filter malformed MMS Read requests with out-of-range indices.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48741. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart