Null Pointer Dereference in libIEC61850 Open-Source Implementation

CVE-2026-48741

What is CVE-2026-48741?

A null pointer dereference vulnerability exists in the libIEC61850 implementation prior to version 1.6.2. The issue arises from the alternateArrayAccess in the mms_read_service.c source file, which fails to validate an alternate-access sub-array range when the numberOfElements is greater than zero. This oversight can lead to a crash of the server when a remote MMS Read request is processed, particularly when the data model includes arrays. In cases where an out-of-range index is referenced, a NULL value is returned and subsequently passed to MmsValue_isDeletable, resulting in a null pointer dereference. The vulnerability was rectified in version 1.6.2, enhancing the stability and reliability of the server's response to such invalid indices.

References