CVE-2026-57446 Details
Description
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle but leaves the stale non-NULL value in a task marked MMS_FILE_UPLOAD_STATE_NOT_USED. If a later ObtainFile request reuses that task and destination creation fails, MMS_FILE_UPLOAD_STATE_SEND_OBTAIN_FILE_ERROR_DESTINATION cleanup closes the stale FILE object again. Servers with the MMS file service and ObtainFile enabled can therefore be crashed remotely by the success-then-failure request sequence. This issue is fixed in version 1.6.2.
A double free vulnerability has been identified in the libIEC61850 library, specifically in version 1.6.1, within the implementation of the MMS ObtainFile operation. This vulnerability arises from improper management of file handles in the task state machine. When an ObtainFile request is successfully completed, the associated file handle is closed, but the task object retains a stale pointer to the closed handle. If the same task is later reused for another ObtainFile request that fails to create the destination file, the error handling process mistakenly closes the stale pointer again, leading to a double free error. This issue can be exploited remotely on servers with the MMS file service and ObtainFile functionality enabled, causing the server to crash.
Users are advised to update to libIEC61850 version 1.6.2, where this vulnerability has been fixed. Alternatively, the patch can be applied manually by resetting the file handle to NULL after closing it, ensuring that stale pointers are not reused.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mz-automation/libiec61850/security/advisories/GHSA-cxgr-7v9h-fj9p | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/mz-automation/libiec61850/commit/d86b4a9c7a903641819235e1678b18901518f3cd | [email protected] | Source CodeVendor |
| https://github.com/mz-automation/libiec61850/releases/tag/v1.6.2 | [email protected] | Release NotesVendor |
| https://github.com/mz-automation/libiec61850/security/advisories/GHSA-cxgr-7v9h-fj9p | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-415 | Double Free | [email protected] |
| CWE-664 | Improper Control of a Resource Through its Lifetime | [email protected] |
| CWE-672 | Operation on a Resource after Expiration or Release | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libIEC61850 | 1.6.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |