NULL Pointer Dereference in MMS Write Handler Affects Industrial Control Systems
CVE-2026-50032

8.7HIGH

Key Information:

Vendor

Mz Automation

Status
Libiec61850
Vendor
CVE Published:
23 July 2026

What is CVE-2026-50032?

A NULL pointer dereference vulnerability exists in the MMS Write Named Variable List handler, which can be exploited by network-adjacent attackers. By sending a WriteRequest that includes an empty listOfData field, an attacker may trigger a server crash, disrupting service and potentially leading to further security implications.

Affected Version(s)

libIEC61850 1.0.0 <= 1.6.1

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
government-resource

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhinav Agarwal reported this vulnerability to CISA
.