Read the docs
TI-2026-15228 Aliases CVE-2026-18582GHSA-vj8r-wqrg-59qf

mz-automation libiec61850 Report Sending Path reporting.c Reporting_RCBWriteAccessHandler free of memory not on the heap

Priority HIGH 70CWE-590Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function Reporting_RCBWriteAccessHandler of the file src/iec61850/server/mms_mapping/reporting.c of the component Report Sending Path Handler. The manipulation results in free of memory not on the heap. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.2 is able to resolve this issue. The patch is identified as 5b2a69f44256b8548927d8afdd7ac5f5381abe1e. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00859 58th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed libiec61850 (mz-automation): 1.6.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MZ Automationlibiec618501.6.0; 1.6.11.6.2Patch availableCNA
  • libiec61850 VendorMZ Automation Affected 1.6.0; 1.6.1 Fixed in 1.6.2 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:mz-automation:libiec61850:*:*:*:*:*:*:*:*——MZ Automation
  • cpe:2.3:a:mz-automation:libiec61850:*:*:*:*:*:*:*:* Versions — — ·MZ Automation

Remediation

  • Fix · CNA libiec61850 (mz-automation) Fixed in 1.6.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-18582
  2. 2026-10-03 Alias added: GHSA-vj8r-wqrg-59qf

References

Exploit 1

Patch 2

Other 2

  • TI-2026-75355 Infinite loop and out-of-bounds read in libIEC61850 ACSE parsing CVSS 4.0HIGH 8.7
  • TI-2026-75345 Remote NULL dereference in libIEC61850 MMS Read crashes servers CVSS 3.1HIGH 7.5
  • TI-2026-75344 Remote information disclosure in libIEC61850 MMS file service CVSS 3.1HIGH 7.5
  • TI-2024-18824 In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the… CVSS 3.1HIGH 7.5
  • TI-2022-05561 Infinite loop in MZ Automation libiec61850 CVSS 3.1HIGH 7.5
  • TI-2026-45011 MZ Automation lib60870 Out-of-bounds Read CVSS 4.0MEDIUM 6.9
See all 64 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences