Read the docs
TI-2026-75350 Aliases CVE-2026-57446

Double free in libIEC61850 MMS ObtainFile handling

Priority MEDIUM 63CWE-415Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

libIEC61850 from 1.6.1 before 1.6.2 is affected. A successful MMS ObtainFile operation closes a file handle but leaves its stale value in a reusable task, so a later ObtainFile request that reuses the task and fails while creating the destination closes the same file again (CWE-415). A remote, unauthenticated attacker can crash servers that enable the MMS file service and ObtainFile by triggering this cleanup path.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle but leaves the stale non-NULL value in a task marked MMS_FILE_UPLOAD_STATE_NOT_USED. If a later ObtainFile request reuses that task and destination creation fails, MMS_FILE_UPLOAD_STATE_SEND_OBTAIN_FILE_ERROR_DESTINATION cleanup closes the stale FILE object again. Servers with the MMS file service and ObtainFile enabled can therefore be crashed remotely by the success-then-failure request sequence. This issue is fixed in version 1.6.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00401 34th percentileScored 2026-11-07
Fix Fixed libiec61850 (mz-automation): 1.6.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MZ Automationlibiec618501.6.1 to before 1.6.21.6.2Patch availableCNA
  • libiec61850 VendorMZ Automation Affected 1.6.1 to before 1.6.2 Fixed in 1.6.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:mz-automation:libiec61850:*:*:*:*:*:*:*:*——MZ Automation
  • cpe:2.3:a:mz-automation:libiec61850:*:*:*:*:*:*:*:* Versions — — ·MZ Automation

Remediation

The fix is in libiec61850 version 1.6.2.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA libiec61850 (mz-automation) Fixed in 1.6.2

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-57446
  2. 2026-10-28 CISA SSVC decision points changed
  3. 2026-10-28 Priority changed: LOW → MEDIUM

References

Other 3

  • TI-2026-75355 Infinite loop and out-of-bounds read in libIEC61850 ACSE parsing CVSS 4.0HIGH 8.7
  • TI-2026-75345 Remote NULL dereference in libIEC61850 MMS Read crashes servers CVSS 3.1HIGH 7.5
  • TI-2026-75344 Remote information disclosure in libIEC61850 MMS file service CVSS 3.1HIGH 7.5
  • TI-2024-18824 In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the… CVSS 3.1HIGH 7.5
  • TI-2022-05561 Infinite loop in MZ Automation libiec61850 CVSS 3.1HIGH 7.5
  • TI-2026-45011 MZ Automation lib60870 Out-of-bounds Read CVSS 4.0MEDIUM 6.9
See all 64 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences