CVE-2026-68908 Details
Description
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, Reporting_RCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes sendNextReportEntrySegment to serialize the report, the function wraps rptIdBuf[130] as a temporary MmsValue and passes it to MmsValue_setVisibleString. The setter's resize path frees the stack-backed buffer, allowing a remote client to trigger an invalid free and server crash by writing the oversized RptID and then generating a report. This issue is fixed in version 1.6.2.
A stack-based buffer overflow vulnerability has been identified in libIEC61850 versions prior to 1.6.2. The issue arises in the MMS server's reporting control block (RCB) write path, specifically within the 'Reporting_RCBWriteAccessHandler' function. When a client sends an oversized RptID exceeding 129 bytes, the server later crashes while processing the report. The vulnerability is triggered when the 'sendNextReportEntrySegment' function attempts to serialize the RptID, which has been improperly stored, leading to a memory corruption error. This flaw allows for a remote denial-of-service condition, causing the server to crash.
Users are advised to update to libIEC61850 version 1.6.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mz-automation/libiec61850/security/advisories/GHSA-7qg8-hm25-rv5v | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/mz-automation/libiec61850/commit/5b2a69f44256b8548927d8afdd7ac5f5381abe1e | [email protected] | Source CodeVendor |
| https://github.com/mz-automation/libiec61850/releases/tag/v1.6.2 | [email protected] | Release NotesVendor |
| https://github.com/mz-automation/libiec61850/security/advisories/GHSA-7qg8-hm25-rv5v | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-590 | Free of Memory not on the Heap | [email protected] |
| CWE-664 | Improper Control of a Resource Through its Lifetime | [email protected] |
| CWE-763 | Release of Invalid Pointer or Reference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libIEC61850 | <= 1.6.1 (semver) v1.6_develop branch before commit 5b2a69f |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |