libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle but leaves the stale non-NULL value in a task marked MMSFILEUPLOADSTATENOTUSED. If a later ObtainFile request reuses that task and destination creation fails, MMSFILEUPLOADSTATESENDOBTAINFILEERRORDESTINATION cleanup closes the stale FILE object again. Servers with the MMS file service and ObtainFile enabled can therefore be crashed remotely by the success-then-failure request sequence. This issue is fixed in version 1.6.2.

A vulnerability has been found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function MmsMappingvarAccessSpecToObjectReference of the file src/iec61850/common/iec61850common.c of the component MMS Protocol Workflow. Such manipulation of the argument GetNamedVariableListAttributesResponse.itemId leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiverstopThreadless of the file src/sampledvalues/svsubscriber.c of the component ASDU Element Handler. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.2 is able to mitigate this issue. The patch is named a96bd674e0238276dd1387d31d52e55229d0771e. The affected component should be upgraded.

A vulnerability was found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function deleteDataSetValuesShadowBuffer of the file src/iec61850/server/mmsmapping/reporting.c of the component URCB Revalidation. The manipulation results in use after free. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 1.6.2 is sufficient to fix this issue. The patch is identified as 486fd57f3aed65bb9d636ff00f9ddce2e450b168. Upgrading the affected component is advised.

A crafted IEC 60870-5-104 I-frame with TypeID 104 (CTSNA1) and an inflated object count causes TestCommandgetFromBuffer to read one byte past the end of the heap-allocated message buffer.

A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObjectParseObjectAddress to read one byte past the end of the heap-allocated message buffer.

The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 multicast messages. A specially crafted GOOSE frame containing an undersized timestamp field can trigger a heap out-of-bounds read during message processing, causing the process to crash and resulting in a denial-of-service condition.

The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is received over an established MMS session (TCP port 102), the decoder may advance its internal read position incorrectly, leading to a heap out-of-bounds read. This condition causes the MMS handling process to terminate unexpectedly, resulting in a denial-of-service.

The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean/integer): an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-service condition.

The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. When processing specific payload fields, an attacker controlled inner element length may exceed its enclosing length, causing the parser to over read by one byte. This out-of-bounds read reliably terminates the subscriber process, resulting in a denial-of-service condition.

The MMS server connection handler contains a flaw in its processing of BER-encoded request data. When an MMS confirmed request PDU containing an extended BER tag is received over an established session, the decoder may advance its internal buffer incorrectly due to a missing bounds check. This results in a one byte heap out-of-bounds read and causes the MMS service process to terminate, leading to a denial-of-service condition.

The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of the encoded presentation data allows an attacker controlled field with a zero length value to trigger a bounded heap over read. This condition occurs before MMS session establishment, a crafted TCP/102 connection attempt can trigger the issue. The resulting over read causes the process to terminate, leading to a denial of service condition.

Hello,

libIEC61850 (MZ Automation), the widely used open-source IEC 61850 stack for electric-substation MMS and GOOSE, contains four memory-safety vulnerabilities in its MMS and GOOSE handling: CVE-2026-49035, CVE-2026-50039, CVE-2026-50032, and CVE-2026-50103. All are fixed in v1.6.2. In the tested default configurations, the triggering requests or frames require no application credentials. The issues cause denial of service under the deployment conditions described below; CVE-2026-49035 additionally produced command execution in a deliberately unhardened laboratory build.

Affected range: v1.0.0 through v1.6.1. I reproduced all four issues against commit a1396111, the v1.6.1 tip used for testing. Coordinated through CISA (advisory ICSA-26-204-06).

The MMS PoCs require no application credentials against the tested default server configuration; the GOOSE issue is triggered by a single crafted Layer-2 frame. Applications may separately configure authentication, TLS, access-control callbacks, or network restrictions.

Remediation: upgrade to v1.6.2, or backport the four referenced fixes. Deployments that cannot update should restrict MMS reachability, disable or restrict unnecessary MMS file services, and reject untrusted GOOSE traffic at the network boundary where operationally possible.

CWE ids and CVSS v3.1 scores/vectors below are the published CISA advisory values.

CVE Component Class CWE CVSS 3.1 -------------- ----------------- -------------- ---- -------- CVE-2026-49035 MMS file service Heap overflow 122 8.1 CVE-2026-50039 MMS value cache Stack overflow 121 7.5 CVE-2026-50032 MMS write service NULL deref 476 7.5 CVE-2026-50103 GOOSE subscriber Invalid struct 228 6.5

CVE-2026-49035 -- MMS FileRead heap overflow -> RCE (lab) mmsfileservice.c / mmsassociationservice.c

The server accepts a client-supplied maxPduSize during MMS Initiate with no lower bound. maxFileChunkSize = maxPduSize - 20 underflows to a near-maximal uint32t when maxPduSize < 20 -- an integer-underflow root cause (CWE-191) underlying the heap overflow -- bypassing the chunk-size guard, so a FileRead response copies an entire staged file into a fixed 65,100-byte heap buffer. In the default build profile ObtainFile is compiled in alongside the MMS file service, allowing a sufficiently large file to be staged remotely when the application has not disabled or restricted that functionality; the file is then read back to trigger the overflow. With the file service reachable and a sufficiently large file available or staged through ObtainFile, the overflow reliably crashes the server.

In a deliberately unhardened lab build (AArch64, non-PIE, ASLR off, writable GOT) I reproduced the full chain -- a free@GOT overwrite reaching system(), end-to-end command execution -- verified by an strace execve capture and a nonce-stamped proof file. In the tested environment, enabling PIE and ASLR would require an additional address-disclosure or equivalent exploit primitive; I did not demonstrate such a primitive.

Fix status: v1.6.2, commit db35acf6. CVSS 3.1: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVE-2026-50039 -- MMS value-cache stack buffer overflow mmsvaluecache.c

MmsValueCachelookupValue copies the looked-up item identifier into a fixed char itemIdCopy[65] with an unbounded copy (StringUtilscopyStringToBuffer, no destination size). An unauthenticated ReadRequest overflows the stack buffer when the server model exposes an object whose item identifier exceeds 64 bytes (ASAN: stack WRITE of size 87 on an 86-char path; a canary build aborts via stackchkfail). Deployment-conditional on such a model; the copy is unsafe regardless.

Fix status: v1.6.2, commit a0bd0aaa CVSS 3.1: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVE-2026-50032 -- MMS Write NULL-pointer dereference mmswriteservice.c

A WriteRequest naming an existing Named Variable List with an empty listOfData (A0 00, accepted by the decoder) sets the data array to NULL, which the write loop dereferences. This path iterates on the server-side member count without checking the client's listOfData count; the sibling listOfVariable path has that guard, this one does not. Unauthenticated single-request crash against the tested default (no access control).

Fix status: v1.6.2, commit bd338f23. CVSS 3.1: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVE-2026-50103 -- GOOSE parser supplies NULL dataset element to callback goosereceiver.c

The two-pass TLV parser (parseAllDataUnknownValue) allocates a dataset slot in pass 1 but leaves it NULL in pass 2 when a recognized type carries an invalid length: 0x87/Float (valid 5, 9), 0x8c/BinaryTime (valid 4, 6), 0x91/UTCTime (valid 8). The NULL element reaches the subscriber callback; a callback that reads it with ordinary MmsValue accessors -- the pattern in the library's own examples and the PoC -- calls MmsValuegetType(NULL) and crashes. One malformed Layer-2 GOOSE frame, delivered on the local segment, is enough.

The same function backs the optional beta R-GOOSE (UDP) path, disabled by default (CONFIGIEC61850RGOOSE 0); identified by source review, not tested.

Fix status: v1.6.2, commit 62f22887. CVSS 3.1: 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected: libIEC61850 v1.0.0 through v1.6.1 (all four). Fixed in v1.6.2.

Note: Beyond these four, v1.6.2 also ships several other security-related fixes (see the release notes and CHANGELOG); those do not appear to carry separate CVE assignments.

Timeline: 2026-05-07 Reported four issues to the maintainer. 2026-05-08 All four fixed on the public v1.6develop branch. 2026-06-09 CVEs reserved. 2026-07-03 Notified CISA and the vendor of intent to publish PoC code after the CISA advisory is published. 2026-07-23 v1.6.2 released; CISA advisory ICSA-26-204-06 published; writeup and PoC published; this disclosure.

PoCs (per-CVE crash harnesses + the Dockerized end-to-end RCE, with ASAN/GDB logs, pcaps, patch diffs, and negative controls) and the full write-up -- root cause, exploit chain, and timeline -- are linked below.

References: Write-up: https://abhinavagarwal07.github.io/posts/libiec61850-mms-goose-cves?src=oss PoC code: https://github.com/abhinavagarwal07/libiec-security-poc CISA Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-06 Vendor Release: https://github.com/mz-automation/libiec61850/releases/tag/v1.6.2

Reported and coordinated by Abhinav Agarwal.

-- Abhinav Agarwal

A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value.

NULL pointer dereference in the MMS Client in MZ Automation LibIEC1850 before commit 7afa40390b26ad1f4cf93deaa0052fe7e357ef33 allows a malicious server to Cause a Denial-of-Service via the MMS InitiationResponse message.

Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit ac925fae8e281ac6defcd630e9dd756264e9c5bc allow a malicious server to cause a stack-based buffer overflow via the MMS FileDirResponse message.

Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit 1f52be9ddeae00e69cd43e4cac3cb4f0c880c4f0 allow a malicious server to cause a stack-based buffer overflow via the MMS IdentifyResponse message.