libIEC61850: Infinite loop and out-of-bounds read in ACSE parser
Summary
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols. In versions before 1.6.2, the ACSE parser (parseUserInformation) mishandles a truncated length field in a malformed AARE PDU received during association. An unauthenticated remote peer can exploit this to cause an infinite CPU loop, or a one-byte out-of-bounds read that aborts the process if the preceding byte is inaccessible. The issue is relevant where an MMS server built with the library is reachable over the network.
Affected
- libIEC61850 versions before 1.6.2 (CNA range: < 1.6.2)
- Note: VulDB states up to 1.6.1 and Mend states 1.6.0 to 1.6.2; the CNA range is treated as authoritative.
- Versions before 1.6.0: Unknown.
Fixed in
- Version 1.6.2 (LIB61850-562, GHSA-f7xm-q62q-22cx)
- Later release 1.6.2.1 exists; whether it is required for this CVE alone is unknown.
Workaround
- Unknown. No vendor-published workaround was found.
- Limit network access to the MMS/IEC 61850 service (port 102 is standard for MMS over TCP) to known clients using segmentation and firewall rules.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable: yes, technical impact: partial.
- No evidence of in-the-wild exploitation was found.
- Public proof of concept: Unknown (no dedicated search performed).
- EPSS is low (0.00471 according to Vulners).
Our recommendation
- Identify where libIEC61850 is used, including in vendor IEDs, gateways and energy-sector software.
- Ask software vendors for an update to libIEC61850 1.6.2 or later.
- Check whether any MMS server is reachable from untrusted networks and restrict access.
- Monitor for crashes or high CPU usage of affected services.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record mirror (Strix) www.strix.ai
- GitHub Security Advisory GHSA-f7xm-q62q-22cx github.com
- Fix commit 2edf2a1 github.com
- Release 1.6.2 notes github.com
- VulDB entry 421328 vuldb.com
- Vulners VulnRichment CVE-2026-68906 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:17.
Original description (NVD)
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path therefore swallows the error, reads buffer[-1], resets parsing to the beginning, and repeats the same malformed state. An unauthenticated remote peer can send a malformed AARE PDU during association to cause an infinite CPU loop under a normal allocator or a one-byte out-of-bounds read and process abort when the preceding byte is inaccessible. This issue is fixed in version 1.6.2.
NVD references (4)
- https://github.com/mz-automation/libiec61850/commit/2edf2a12bf0ced6a2ac595862e3e873814983f7f
- https://github.com/mz-automation/libiec61850/releases/tag/v1.6.2
- https://github.com/mz-automation/libiec61850/security/advisories/GHSA-f7xm-q62q-22cx
- https://github.com/mz-automation/libiec61850/security/advisories/GHSA-f7xm-q62q-22cx
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.