CVE-2026-48741 Details
Description
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValue_getElement call returns NULL, and the sub-array branch passes that value to MmsValue_isDeletable, causing a NULL pointer dereference. A remote MMS Read request can therefore crash servers whose data models contain arrays, while the single-element error path handles the same invalid index safely. This issue is fixed in version 1.6.2.
A NULL pointer dereference vulnerability has been identified in libIEC61850 versions prior to 1.6.2. The issue arises in the MMS Read service when handling array data models. Specifically, the vulnerability is located in the 'alternateArrayAccess' function within the MMS read service component. When a remote client sends a read request for an array sub-range with more than zero elements, the server fails to validate the requested range. This oversight allows out-of-bounds access, leading to a crash when the server attempts to dereference a NULL value. In contrast, single-element reads that go out of range are properly managed by returning an error, highlighting the inconsistent handling of array access.
Users are advised to update to libIEC61850 version 1.6.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mz-automation/libiec61850/security/advisories/GHSA-8mfr-hq64-9w33 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/mz-automation/libiec61850/commit/7c15310405def00cac628ebde4ce1404bfb8a411 | [email protected] | Source CodeVendor |
| https://github.com/mz-automation/libiec61850/releases/tag/v1.6.2 | [email protected] | Release NotesVendor |
| https://github.com/mz-automation/libiec61850/security/advisories/GHSA-8mfr-hq64-9w33 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-129 | Improper Validation of Array Index | [email protected] |
| CWE-252 | Unchecked Return Value | [email protected] |
| CWE-476 | NULL Pointer Dereference | [email protected] |
| CWE-754 | Improper Check for Unusual or Exceptional Conditions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mz-automation libIEC61850 | <= 1.6.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |