CVE-2026-68908: libIEC61850: Oversized RptID can trigger invalid free of a stack-backed visible string in the report send path
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, ReportingRCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes sendNextReportEntrySegment to serialize the report, the function wraps rptIdBuf[130] as a temporary MmsValue and passes it to MmsValuesetVisibleString. The setter's resize path frees the stack-backed buffer, allowing a remote client to trigger an invalid free and server crash by writing the oversized RptID and then generating a report. This issue is fixed in version 1.6.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libIEC61850to a version that resolves this vulnerability.Fixed in 1.6.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Servers using libIEC61850 versions before 1.6.2 are affected when they expose the report-control-block write path to remote clients.
What must an attacker do to cause the crash?
A remote client must write an RptID longer than 129 bytes through Reporting_RCBWriteAccessHandler, then cause a general interrogation (GI) that generates and serializes a report. No authentication or user interaction is required according to the supplied vector.
What is the expected impact?
The oversized RptID causes an invalid free of a stack-backed buffer during report serialization, which can crash the server. The provided impact assessment indicates availability impact only, with no confidentiality or integrity impact.
How can I determine whether an instance may be affected?
Check whether the deployed libIEC61850 version is earlier than 1.6.2 and whether remote clients can write report control blocks and trigger reporting. Affected systems may crash after an oversized RptID is accepted and a subsequent GI produces a report.