Denial of Service Risk in libIEC61850 by MZ Automation
CVE-2026-68907

8.2HIGH

Key Information:

Vendor

Mz-automation

Status
Libiec61850
Vendor
CVE Published:
16 October 2026

What is CVE-2026-68907?

The libIEC61850 library, which implements IEC 61850 protocols, has a vulnerability where the checkDataSetAccess function improperly reverses source and destination arguments during the construction of an MMS_ASSOCIATION_SPECIFIC dataset reference. This leads to the exploitation of uninitialized storage, causing out-of-bounds memory access and potential stack corruption. A remote request could trigger a denial of service by crashing servers with enabled dynamic dataset services. The vulnerability is resolved in version 1.6.2.

Affected Version(s)

libiec61850 < 1.6.2

References

https://github.com/mz-automation/libiec61850/security/adv...
x_refsource_CONFIRM
https://github.com/mz-automation/libiec61850/commit/06206...
x_refsource_MISC
https://github.com/mz-automation/libiec61850/releases/tag...
x_refsource_MISC

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.