Read the docs
TI-2026-15229 Aliases CVE-2026-18583GHSA-948g-pq52-gmvq

mz-automation libiec61850 MMS Request mms_mapping.c checkDataSetAccess out-of-bounds

Priority HIGH 70CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A weakness has been identified in mz-automation libiec61850 up to 1.6.1. This issue affects the function checkDataSetAccess of the file src/iec61850/server/mms_mapping/mms_mapping.c of the component MMS Request Handler. This manipulation causes out-of-bounds read. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.6.2 is capable of addressing this issue. Patch name: 062062daf4cb50c7aa76e01d6fb4d58fc9278a7d. Upgrading the affected component is recommended. The vendor was contacted early about this disclosure.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00859 58th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed libiec61850 (mz-automation): 1.6.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MZ Automationlibiec618501.6.0; 1.6.11.6.2Patch availableCNA
  • libiec61850 VendorMZ Automation Affected 1.6.0; 1.6.1 Fixed in 1.6.2 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:mz-automation:libiec61850:*:*:*:*:*:*:*:*——MZ Automation
  • cpe:2.3:a:mz-automation:libiec61850:*:*:*:*:*:*:*:* Versions — — ·MZ Automation

Remediation

  • Fix · CNA libiec61850 (mz-automation) Fixed in 1.6.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-18583
  2. 2026-10-03 Alias added: GHSA-948g-pq52-gmvq

References

Exploit 1

Patch 2

Other 2

  • TI-2026-75355 Infinite loop and out-of-bounds read in libIEC61850 ACSE parsing CVSS 4.0HIGH 8.7
  • TI-2026-75345 Remote NULL dereference in libIEC61850 MMS Read crashes servers CVSS 3.1HIGH 7.5
  • TI-2026-75344 Remote information disclosure in libIEC61850 MMS file service CVSS 3.1HIGH 7.5
  • TI-2024-18824 In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the… CVSS 3.1HIGH 7.5
  • TI-2022-05561 Infinite loop in MZ Automation libiec61850 CVSS 3.1HIGH 7.5
  • TI-2026-45011 MZ Automation lib60870 Out-of-bounds Read CVSS 4.0MEDIUM 6.9
See all 64 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences