CVE-2026-18582: mz-automation libiec61850 Report Sending Path reporting.c Reporting_RCBWriteAccessHandler free of memory not on the heap
A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function ReportingRCBWriteAccessHandler of the file src/iec61850/server/mmsmapping/reporting.c of the component Report Sending Path Handler. The manipulation results in free of memory not on the heap. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.2 is able to resolve this issue. The patch is identified as 5b2a69f44256b8548927d8afdd7ac5f5381abe1e. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mz-automation libiec61850to a version that resolves this vulnerability.Fixed in 1.6.2Patch 5b2a69f44256b8548927d8afdd7ac5f5381abe1e
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18582?
The severity of CVE-2026-18582 is rated as medium with a score of 5.3.
How do I fix CVE-2026-18582?
To fix CVE-2026-18582, update mz-automation libiec61850 to version 1.6.2 or later where the vulnerability has been addressed.
What component is affected by CVE-2026-18582?
CVE-2026-18582 affects the Report Sending Path Handler in the mz-automation libiec61850 software.
What risks are associated with CVE-2026-18582?
The risks associated with CVE-2026-18582 include potential memory manipulation which may lead to denial of service.
Which function in mz-automation libiec61850 is compromised in CVE-2026-18582?
The compromised function in mz-automation libiec61850 is Reporting_RCBWriteAccessHandler located in the src/iec61850/server/mms_mapping/reporting.c file.