CVE-2026-68908

Published: Ott 16, 2026 Last Modified: Ott 16, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: low

Description

AI Translation Available

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, Reporting_RCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes sendNextReportEntrySegment to serialize the report, the function wraps rptIdBuf[130] as a temporary MmsValue and passes it to MmsValue_setVisibleString. The setter's resize path frees the stack-backed buffer, allowing a remote client to trigger an invalid free and server crash by writing the oversized RptID and then generating a report. This issue is fixed in version 1.6.2.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0045
Percentile
0,4th
Updated

EPSS Score Trend (Last 3 Days)

590

Free of Memory not on the Heap

Incomplete
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability
Potential Impacts:
Execute Unauthorized Code Or Commands Modify Memory
Applicable Platforms
Languages: Memory-Unsafe, C
View CWE Details
664

Improper Control of a Resource Through its Lifetime

Draft
Abstraction: Pillar Structure: Simple
Common Consequences
Security Scopes Affected:
Other
Potential Impacts:
Other
Applicable Platforms
All platforms may be affected
View CWE Details
763

Release of Invalid Pointer or Reference

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Availability Confidentiality
Potential Impacts:
Modify Memory Dos: Crash, Exit, Or Restart Execute Unauthorized Code Or Commands
Applicable Platforms
Languages: Memory-Unsafe, C, C++
View CWE Details
https://github.com/mz-automation/libiec61850/security/advis…
https://github.com/mz-automation/libiec61850/security/advisories/GHSA-7qg8-hm25…
https://github.com/mz-automation/libiec61850/commit/5b2a69f…
https://github.com/mz-automation/libiec61850/commit/5b2a69f44256b8548927d8afdd7…
https://github.com/mz-automation/libiec61850/releases/tag/v…
https://github.com/mz-automation/libiec61850/releases/tag/v1.6.2
https://github.com/mz-automation/libiec61850/security/advis…
https://github.com/mz-automation/libiec61850/security/advisories/GHSA-7qg8-hm25…