CVE-2026-19108: MZ Automation libiec61850 URCB Revalidation reporting.c deleteDataSetValuesShadowBuffer use after free
A vulnerability was found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function deleteDataSetValuesShadowBuffer of the file src/iec61850/server/mmsmapping/reporting.c of the component URCB Revalidation. The manipulation results in use after free. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 1.6.2 is sufficient to fix this issue. The patch is identified as 486fd57f3aed65bb9d636ff00f9ddce2e450b168. Upgrading the affected component is advised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MZ Automation libiec61850 (URCB Revalidation)to a version that resolves this vulnerability.Fixed in 1.6.2Patch 486fd57f3aed65bb9d636ff00f9ddce2e450b168
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19108?
The severity of CVE-2026-19108 is classified as medium with a score of 5.3.
What is the nature of the vulnerability in CVE-2026-19108?
CVE-2026-19108 is a use after free vulnerability found in the deleteDataSetValuesShadowBuffer function of MZ Automation libiec61850.
What are the potential consequences of CVE-2026-19108?
Exploitation of CVE-2026-19108 can lead to memory corruption and can potentially allow an attacker to manipulate or crash the system.
How do I fix CVE-2026-19108?
To mitigate CVE-2026-19108, update MZ Automation libiec61850 to the latest version where the vulnerability has been addressed.
Which versions of MZ Automation libiec61850 are affected by CVE-2026-19108?
CVE-2026-19108 affects MZ Automation libiec61850 versions up to 1.6.1.