CVE-2026-68907
Received Received - Intake

libIEC61850 Stack Buffer Overflow in MMS Dataset Handling

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtils_copyStringToBuffer while constructing an MMS_ASSOCIATION_SPECIFIC dataset reference. The helper treats uninitialized dataSetRef[130] storage as a source string, causing strlen to read beyond the stack buffer, and then copies those bytes into the caller-owned listName buffer. A remote defineNamedVariableList request can crash servers that have dynamic dataset service enabled and a dataset access handler installed; the advisory also observes caller stack corruption but establishes denial of service as the primary impact. This issue is fixed in version 1.6.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-68907
EUVD
EUVD-2026-102911

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mz-automation libiec61850 < 1.6.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-457 The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
CWE-628 The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in libIEC61850, an open-source implementation of IEC 61850 protocols. Prior to version 1.6.2, a function called checkDataSetAccess incorrectly reverses source and destination arguments when handling MMS_ASSOCIATION_SPECIFIC dataset references. This causes the function to read uninitialized memory and copy it into a caller-owned buffer, leading to potential crashes or stack corruption in servers with dynamic dataset service enabled.

Detection Guidance

This vulnerability affects libIEC61850 versions prior to 1.6.2. To detect it, check the installed version of libIEC61850 on your system using commands like 'dpkg -l libiec61850' or 'rpm -qa | grep libiec61850'. If the version is below 1.6.2, the system is vulnerable.

Impact Analysis

This vulnerability can allow a remote attacker to crash servers running vulnerable versions of libIEC61850 by sending a specially crafted defineNamedVariableList request. This results in a denial of service (DoS) condition, disrupting the availability of the affected system.

Compliance Impact

This vulnerability primarily causes denial of service by crashing servers through remote requests, which could disrupt operations handling sensitive data. For GDPR, it may impact availability of systems processing personal data. For HIPAA, service disruptions could affect systems managing protected health information. However, the vulnerability does not directly expose or leak data, so primary compliance risks are operational rather than data protection.

Mitigation Strategies

Upgrade libIEC61850 to version 1.6.2 or later immediately. Disable dynamic dataset service if not required. Ensure dataset access handlers are properly configured to prevent stack corruption. Monitor for crashes or unusual activity in MMS_ASSOCIATION_SPECIFIC dataset handling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68907. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart