CVE-2026-57446: libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* handle
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle but leaves the stale non-NULL value in a task marked MMSFILEUPLOADSTATENOTUSED. If a later ObtainFile request reuses that task and destination creation fails, MMSFILEUPLOADSTATESENDOBTAINFILEERRORDESTINATION cleanup closes the stale FILE object again. Servers with the MMS file service and ObtainFile enabled can therefore be crashed remotely by the success-then-failure request sequence. This issue is fixed in version 1.6.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libIEC61850to a version that resolves this vulnerability.Fixed in 1.6.2
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
Servers running affected libIEC61850 versions from 1.6.1 up to, but not including, 1.6.2 are exposed if both the MMS file service and ObtainFile functionality are enabled. The attack is remote and requires no privileges or user interaction.
What request sequence is required to trigger the crash?
An attacker must first complete an MMS ObtainFile operation successfully, then send another ObtainFile request that reuses the task and causes destination creation to fail. The failure path attempts to close a stale FILE handle a second time.
What is the impact of successful exploitation?
The documented impact is a remotely triggerable server crash, resulting in an availability loss. No confidentiality or integrity impact is specified.
How can this be remediated or mitigated?
Upgrade to libIEC61850 version 1.6.2, which fixes the issue. If upgrading is not immediately possible, disabling the MMS file service or ObtainFile functionality removes the stated exposure condition.