Out-of-Range Initial Position Vulnerability in libIEC61850 by MZ Automation

CVE-2026-48503

What is CVE-2026-48503?

The libIEC61850 library, utilized for IEC 61850 client and server communications, has a vulnerability in its MMS file service. This issue manifests when an out-of-range initial position is provided during the fileOpen operation, leading to improper handling of read requests. As a consequence, the system may allow an unauthenticated remote client to access stale bytes from prior responses due to incorrect unsigned arithmetic. The vulnerability is addressed in version 1.6.2, which enhances the file-read state validation and response handling, thus mitigating the risk of unintended data exposure.

References