CVE-2026-65421 Details
Description
The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean/integer): an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-service condition.
A denial-of-service vulnerability has been identified in the MZ Automation GmbH libiec61850 MMS BER decoder. The issue arises from a flaw in decoding fixed-width BER fields, such as boolean and integer types. The vulnerability allows an attacker to supply a length value that is not properly validated, leading to a read operation that exceeds the bounds of a heap buffer. This out-of-bounds read causes the MMS service process to terminate, creating a denial-of-service condition.
Users are advised to update to version 1.6.2.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 31, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |