CVE-2026-48741: libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoS
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/isomms/server/mmsreadservice.c does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValuegetElement call returns NULL, and the sub-array branch passes that value to MmsValueisDeletable, causing a NULL pointer dereference. A remote MMS Read request can therefore crash servers whose data models contain arrays, while the single-element error path handles the same invalid index safely. This issue is fixed in version 1.6.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libIEC61850to a version that resolves this vulnerability.Fixed in 1.6.2
Event History
Frequently Asked Questions
Which deployments are exposed to a remote crash?
Servers using libIEC61850 before version 1.6.2 are exposed if their data models contain arrays and they accept MMS Read requests. The issue can be triggered remotely and requires no privileges or user interaction.
What request condition triggers the failure?
The vulnerable path is an MMS Read request using alternate access for a sub-array with numberOfElements greater than zero and an out-of-range element index. The invalid lookup returns NULL, which is then dereferenced in the sub-array handling branch.
Is this an availability issue only?
Based on the reported impact, successful exploitation crashes the server, causing a denial of service. No confidentiality or integrity impact is reported.
What should be done if an immediate upgrade is not possible?
The provided information identifies the vulnerable condition as remotely reachable MMS Read handling. Restricting access to the affected MMS server to trusted clients can reduce exposure until upgrading to 1.6.2.