Heap Buffer Overflow in MMS Connection Establishment of ACSE Layer by Vendor X
CVE-2026-56758
6.9MEDIUM
What is CVE-2026-56758?
A vulnerability exists in the ACSE layer during the establishment of MMS connections. Specifically, it arises from improper processing of AARQ PDUs, where an attacker may provide a length value that leads to parsing issues within the calling AP title. This can cause the parser to read beyond the boundaries of a heap buffer, potentially allowing for unauthorized access or system compromise.
Affected Version(s)
libiec61850 0 < 1.6.2
libiec61850 1.6.2
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Arun Babu of Central Power Research Institute reported this vulnerability to CISA.