MZ Automation libIEC61850: 4 CVEs, High 8.1
Summary
CISA reports 4 vulnerabilities in MZ Automation libIEC61850. Weakness types: Stack-based Buffer Overflow, Heap-based Buffer Overflow, Improper Handling of Syntactically Invalid Structure (+1 more). Successful exploitation of these vulnerabilities could allow an unauthenticated network-adjacent attacker to crash critical IEC 61850 services or execute arbitrary code, disrupting or compromising protection, visibility, and control functions. Highest CVSS v3 score: 8.1 (High), exploitable over the network.
At a glance
- Vendor
- MZ Automation
- Products
- libIEC61850
- CVEs
- CVE-2026-50039, CVE-2026-49035, CVE-2026-50103, CVE-2026-50032
- Highest CVSS v3
- 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Energy, Transportation Systems
- Deployed
- Worldwide
- Vendor HQ
- Germany
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-50039 | Stack-based Buffer Overflow | 7.5 | – | No | The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to cause a memory corruption via a ReadRequest. |
| CVE-2026-49035 | Heap-based Buffer Overflow | 8.1 | – | No | The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled. |
| CVE-2026-50103 | Improper Handling of Syntactically Invalid Structure | 6.5 | – | No | A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value. |
| CVE-2026-50032 | NULL Pointer Dereference | 7.5 | – | No | A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field. |
Affected products (1)
- MZ Automation libIEC61850: >=v1.0.0|<=v1.6.1
Vendor fixes and mitigations (from advisory)
- Vendor Fix: MZ Automation recommends updating to the latest build of the libIEC61850 standard. Documentation can be found at https://github.com/mz-automation/libiec61850. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.