Infinite Loop Vulnerability in libIEC61850 Product by MZ Automation
CVE-2026-68906

8.7HIGH

Key Information:

Vendor

Mz-automation

Status
Libiec61850
Vendor
CVE Published:
16 October 2026

What is CVE-2026-68906?

The libIEC61850 library, used for implementing the IEC 61850 protocols, contains a vulnerability where improper validation of buffer positions can lead to an infinite loop when a malformed AARE PDU is received from an unauthenticated remote peer. This occurs due to a failure to properly handle negative buffer positions during the parsing process, resulting in a continuous read of the same malformed state. Versions prior to 1.6.2 are affected, and the issue has been addressed in the latest release.

Affected Version(s)

libiec61850 < 1.6.2

References

https://github.com/mz-automation/libiec61850/security/adv...
x_refsource_CONFIRM
https://github.com/mz-automation/libiec61850/commit/2edf2...
x_refsource_MISC
https://github.com/mz-automation/libiec61850/releases/tag...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.