libIEC61850: Out-of-bounds stack read in dynamic dataset creation
Summary
libIEC61850, an open-source library for IEC 61850 client and server protocols (MMS, GOOSE, Sampled Values, R-Session), contains an out-of-bounds stack read when association-specific dataset references are built. A remote, unauthenticated attacker can send a defineNamedVariableList request that crashes an MMS server, causing denial of service. The issue only affects servers with dynamic dataset services enabled and a dataset access handler installed. The advisory also reports stack corruption, so effects beyond a crash cannot be ruled out.
Affected
- libIEC61850 versions before 1.6.2 (VulDB lists up to 1.6.1)
- Commercial products and devices that embed libIEC61850 (versions unknown)
Fixed in
- libIEC61850 1.6.2 or later (fix in commit 062062d)
Workaround
- No vendor workaround known.
- Disabling dynamic dataset services or not installing a dataset access handler should remove the trigger. This is inferred from the description and not confirmed by the vendor; test before relying on it.
- Restrict access to MMS (typically TCP 102) to trusted networks.
Exploitation
- No active exploitation known.
- CISA SSVC: exploitation none, not automatable.
- No confirmed public proof of concept found.
- EPSS very low (0.00371).
Our recommendation
- Check whether you operate IEC 61850 MMS servers or devices and software that embed libIEC61850.
- Update libIEC61850 to 1.6.2 or later, and request patched firmware from device vendors.
- Keep MMS services away from untrusted networks and monitor for crashes or restarts of these services.
- Verify the issue against the GHSA advisory, as the identifiers differ across sources.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-7v2x-39mw-2979 github.com
- Fix commit 062062d github.com
- libIEC61850 release 1.6.2 github.com
- VulDB entry 421329 vuldb.com
- VulDB entry 385412 vuldb.com
- CVE record mirror (threatint) cve.threatint.com
- Vendor news: libIEC61850 1.6.2 libiec61850.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:54.
Original description (NVD)
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtils_copyStringToBuffer while constructing an MMS_ASSOCIATION_SPECIFIC dataset reference. The helper treats uninitialized dataSetRef[130] storage as a source string, causing strlen to read beyond the stack buffer, and then copies those bytes into the caller-owned listName buffer. A remote defineNamedVariableList request can crash servers that have dynamic dataset service enabled and a dataset access handler installed; the advisory also observes caller stack corruption but establishes denial of service as the primary impact. This issue is fixed in version 1.6.2.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.