Heap-Based Buffer Overflow in Affected Product by Vendor
CVE-2026-49035

9.2CRITICAL

Key Information:

Vendor

Mz Automation

Status
Libiec61850
Vendor
CVE Published:
23 July 2026

What is CVE-2026-49035?

The affected product is susceptible to a heap-based buffer overflow triggered by a specially crafted MMS Initiate request. This vulnerability can lead to remote code execution under certain conditions, particularly when Address Space Layout Randomization (ASLR) is disabled. In scenarios where ASLR is enabled, the vulnerability may result in memory corruption or a denial of service, impacting system stability and availability.

Affected Version(s)

libIEC61850 1.0.0 <= 1.6.1

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
government-resource

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhinav Agarwal reported this vulnerability to CISA
.