mz-automation libiec61850 up to 1.6.1 MMS Read Service mms_read_service.c alternateArrayAccess numberOfElements null pointer dereference

Summaryinfo

A vulnerability marked as problematic has been reported in mz-automation libiec61850 up to 1.6.1. Impacted is the function alternateArrayAccess of the file src/mms/iso_mms/server/mms_read_service.c of the component MMS Read Service. This manipulation of the argument numberOfElements causes null pointer dereference. This vulnerability is tracked as CVE-2026-48741. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in mz-automation libiec61850 up to 1.6.1. Affected by this vulnerability is the function alternateArrayAccess of the file src/mms/iso_mms/server/mms_read_service.c of the component MMS Read Service. The manipulation of the argument numberOfElements with an unknown input leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. As an impact it is known to affect availability. The summary by CVE is:

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValue_getElement call returns NULL, and the sub-array branch passes that value to MmsValue_isDeletable, causing a NULL pointer dereference. A remote MMS Read request can therefore crash servers whose data models contain arrays, while the single-element error path handles the same invalid index safely. This issue is fixed in version 1.6.2.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-48741 since 05/22/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.6.2 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• mz-automation

Name

• libiec61850

Version

• 1.6.0
• 1.6.1

Website

• Product: https://github.com/mz-automation/libiec61850/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion