CVE-2026-48503 Details
Description
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, the MMS file service in src/mms/iso_mms/server/mms_file_service.c accepts an out-of-range initialPosition in fileOpen and stores it in the file-read state. The fileRead path then subtracts the larger read position from the file size using unsigned arithmetic and fails to limit the response to the actual FileSystem_readFile return value. The oversized response can include stale bytes from the reused connection buffer after the requested file contents, disclosing prior response data and protocol fragments to an unauthenticated remote client when the file service is enabled. This issue is fixed in version 1.6.2.
A remote information disclosure vulnerability has been identified in libIEC61850 versions through 1.6.1. The issue arises in the MMS file service, where the 'fileOpen' command can be manipulated by sending an out-of-range 'initialPosition'. This unvalidated position is then used in the file-read state, leading to an unsigned arithmetic underflow. Consequently, the 'fileRead' response can include excessive data, such as stale bytes from a previous response on the same connection, along with protocol fragments. This vulnerability allows an unauthenticated remote client to access prior response data when the file service is enabled.
Users of libIEC61850 should update to version 1.6.2, where this vulnerability has been fixed. The update can be downloaded from the libIEC61850 releases page on GitHub.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mz-automation/libiec61850/security/advisories/GHSA-4c8m-jr3r-h8j2 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/mz-automation/libiec61850/commit/bba5bf2fab6d7ac88f5accb4c9e90b123436ebf2 | [email protected] | Source CodeVendor |
| https://github.com/mz-automation/libiec61850/releases/tag/v1.6.2 | [email protected] | Release NotesVendor |
| https://github.com/mz-automation/libiec61850/security/advisories/GHSA-4c8m-jr3r-h8j2 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-191 | Integer Underflow (Wrap or Wraparound) | [email protected] |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-252 | Unchecked Return Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libIEC61850 | <= 1.6.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |