Read the docs
TI-2026-15682 Aliases CVE-2026-19206GHSA-72v3-v5v5-6xx3

MZ Automation libiec61850 ASDU Element sv_subscriber.c SVReceiver_stopThreadless heap-based overflow

Priority MEDIUM 55CWE-119Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiver_stopThreadless of the file src/sampled_values/sv_subscriber.c of the component ASDU Element Handler. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.2 is able to mitigate this issue. The patch is named a96bd674e0238276dd1387d31d52e55229d0771e. The affected component should be upgraded.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00172 6th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed libiec61850 (MZ Automation): 1.6.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MZ Automationlibiec618501.6.0; 1.6.11.6.2Patch availableCNA
  • libiec61850 VendorMZ Automation Affected 1.6.0; 1.6.1 Fixed in 1.6.2 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:mz_automation:libiec61850:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:mz_automation:libiec61850:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA libiec61850 (MZ Automation) Fixed in 1.6.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-19206
  2. 2026-10-03 Alias added: GHSA-72v3-v5v5-6xx3

References

Exploit 1

Patch 2

Other 1

  • TI-2026-75355 Infinite loop and out-of-bounds read in libIEC61850 ACSE parsing CVSS 4.0HIGH 8.7
  • TI-2026-75345 Remote NULL dereference in libIEC61850 MMS Read crashes servers CVSS 3.1HIGH 7.5
  • TI-2026-75344 Remote information disclosure in libIEC61850 MMS file service CVSS 3.1HIGH 7.5
  • TI-2024-18824 In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the… CVSS 3.1HIGH 7.5
  • TI-2022-05561 Infinite loop in MZ Automation libiec61850 CVSS 3.1HIGH 7.5
  • TI-2026-45011 MZ Automation lib60870 Out-of-bounds Read CVSS 4.0MEDIUM 6.9
See all 64 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences