CVE-2026-68906
Received Received - Intake

libIEC61850 MMS Parsing Infinite Loop via Malformed AARE PDU

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path therefore swallows the error, reads buffer[-1], resets parsing to the beginning, and repeats the same malformed state. An unauthenticated remote peer can send a malformed AARE PDU during association to cause an infinite CPU loop under a normal allocator or a one-byte out-of-bounds read and process abort when the preceding byte is inaccessible. This issue is fixed in version 1.6.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-68906
EUVD
EUVD-2026-102912

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mz-automation libiec61850 < 1.6.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-68906 is a vulnerability in the libIEC61850 library affecting versions up to 1.6.1. It involves an infinite loop and out-of-bounds read in the parseUserInformation function when processing a malformed AARE PDU. The issue occurs because the function checks for zero length before validating the buffer position, allowing malformed input to cause a CPU-exhaustion denial-of-service or a 1-byte out-of-bounds heap read.

Detection Guidance

To detect this vulnerability, monitor for abnormal CPU usage spikes or process crashes in systems running libIEC61850 versions prior to 1.6.2. Check logs for repeated parsing errors in MMS/IEC 61850 associations. Use network traffic analysis tools like Wireshark to inspect for malformed AARE PDUs during association attempts.

Impact Analysis

This vulnerability can be exploited by an unauthenticated remote peer during MMS/IEC 61850 association. It may cause denial-of-service through infinite CPU loops or a minor out-of-bounds read leading to process abort. Systems using vulnerable versions of libIEC61850 are at risk of service disruption or potential data corruption.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions and potential out-of-bounds memory access in systems using libIEC61850 versions prior to 1.6.2. While it does not directly violate GDPR or HIPAA, it could indirectly impact compliance by disrupting critical infrastructure operations that rely on IEC 61850 protocols for secure communication. Unauthorized access or service disruption may lead to violations of availability requirements under these regulations.

Mitigation Strategies

Immediately upgrade libIEC61850 to version 1.6.2 or later. If upgrading is not possible, restrict network access to MMS/IEC 61850 ports (typically TCP 102) using firewalls. Monitor affected systems for signs of exploitation or unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68906. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart