connection establishment. When parsing certain fields within the
calling AP title, an attacker controlled length value of zero or one may
cause the parser to read past the end of a heap buffer.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MZ Automation GmbH | libiec61850 | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
MZ Automation GmbH recommends that users update to version 1.6.2.
Workaround
No workaround given by the vendor.
Thu, 30 Jul 2026 22:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, an attacker controlled length value of zero or one may cause the parser to read past the end of a heap buffer. | |
| Title | MZ Automation libiec61850 Out-of-bounds Read | |
| Weaknesses | CWE-125 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: icscert
Published:
Updated: 2026-07-30T22:29:20.516Z
Reserved: 2026-07-27T19:32:49.404Z
Link: CVE-2026-56758
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.