CVE-2026-67873 Details
Description
A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. The issue occurs because FileSegment_encode() validates only the standalone segment length via FileSegment_GetMaxDataSize() and does not verify the residual capacity of the current ASDU frame before encoding object fields and segment data
A heap-based buffer overflow vulnerability has been identified in lib60870-C version 2.4.0. The issue arises in the server-side FileSegment ASDU encoding process, specifically within the 'FileSegment_encode' function. This vulnerability occurs because the encoding function only validates the length of individual FileSegment objects, without checking the available capacity in the ASDU frame. As a result, it is possible to overwrite memory by adding multiple FileSegment objects to an ASDU that is already full.
Users are advised to update to lib60870-C version 2.4.1, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 6, 2026CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mz-automation/lib60870/issues/201 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/mz-automation/lib60870 | [email protected] | ProductVendor |
| https://github.com/mz-automation/lib60870/blob/master/user_guide.adoc | [email protected] | Vendor |
| https://github.com/mz-automation/lib60870/issues/201 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/mz-automation/lib60870/releases/tag/v2.4.0 | [email protected] | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| MZ Automation lib60870-C | 2.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |