Read the docs
TI-2026-15611 Aliases CVE-2026-19108GHSA-c2h4-j5j4-67wf

MZ Automation libiec61850 URCB Revalidation reporting.c deleteDataSetValuesShadowBuffer use after free

Priority MEDIUM 55CWE-119Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability was found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function deleteDataSetValuesShadowBuffer of the file src/iec61850/server/mms_mapping/reporting.c of the component URCB Revalidation. The manipulation results in use after free. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 1.6.2 is sufficient to fix this issue. The patch is identified as 486fd57f3aed65bb9d636ff00f9ddce2e450b168. Upgrading the affected component is advised.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00159 5th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed libiec61850 (MZ Automation): 1.6.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MZ Automationlibiec618501.6.0; 1.6.11.6.2Patch availableCNA
  • libiec61850 VendorMZ Automation Affected 1.6.0; 1.6.1 Fixed in 1.6.2 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:mz_automation:libiec61850:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:mz_automation:libiec61850:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA libiec61850 (MZ Automation) Fixed in 1.6.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-19108
  2. 2026-10-03 Alias added: GHSA-c2h4-j5j4-67wf

References

Exploit 1

Patch 2

Other 1

  • TI-2026-75355 Infinite loop and out-of-bounds read in libIEC61850 ACSE parsing CVSS 4.0HIGH 8.7
  • TI-2026-75345 Remote NULL dereference in libIEC61850 MMS Read crashes servers CVSS 3.1HIGH 7.5
  • TI-2026-75344 Remote information disclosure in libIEC61850 MMS file service CVSS 3.1HIGH 7.5
  • TI-2024-18824 In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the… CVSS 3.1HIGH 7.5
  • TI-2022-05561 Infinite loop in MZ Automation libiec61850 CVSS 3.1HIGH 7.5
  • TI-2026-45011 MZ Automation lib60870 Out-of-bounds Read CVSS 4.0MEDIUM 6.9
See all 64 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences