mz-automation libiec61850 up to 1.6.1 Dataset Access checkDataSetAccess source/destination denial of service

Summaryinfo

A vulnerability classified as problematic has been found in mz-automation libiec61850 up to 1.6.1. The impacted element is the function checkDataSetAccess of the component Dataset Access Handler. Performing a manipulation of the argument source/destination results in denial of service. This vulnerability is cataloged as CVE-2026-68907. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in mz-automation libiec61850 up to 1.6.1. This affects the function checkDataSetAccess of the component Dataset Access Handler. The manipulation of the argument source/destination with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability. The summary by CVE is:

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtils_copyStringToBuffer while constructing an MMS_ASSOCIATION_SPECIFIC dataset reference. The helper treats uninitialized dataSetRef[130] storage as a source string, causing strlen to read beyond the stack buffer, and then copies those bytes into the caller-owned listName buffer. A remote defineNamedVariableList request can crash servers that have dynamic dataset service enabled and a dataset access handler installed; the advisory also observes caller stack corruption but establishes denial of service as the primary impact. This issue is fixed in version 1.6.2.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-68907 since 07/31/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 1.6.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• mz-automation

Name

• libiec61850

Version

• 1.6.0
• 1.6.1

Website

• Product: https://github.com/mz-automation/libiec61850/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion