Heap Buffer Vulnerability in MMS Decoder from Vendor
CVE-2026-65421
7.1HIGH
What is CVE-2026-65421?
A vulnerability exists in the MMS BER decoder, where an attacker can supply an invalid length value during the decoding of fixed-width BER fields. This flaw can lead to an uncontrollable read beyond the heap buffer's end, resulting in the termination of the MMS service process. Consequently, this introduces a denial-of-service scenario, disrupting normal operational functionality and providing an opportunity for exploitation.
Affected Version(s)
libiec61850 0 < 1.6.2
libiec61850 1.6.2
References
CVSS V4
Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Arun Babu of Central Power Research Institute reported this vulnerability to CISA.