CVE-2026-48741

7.5High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-129, CWE-252, CWE-476, CWE-754

Impact

Remote unauthenticated attackers can crash MMS servers whose data models contain arrays. All they need is network access to send a malicious MMS Read request.

Root cause

The alternateArrayAccess function fails to validate sub-array range boundaries when numberOfElements is greater than zero, causing a NULL pointer dereference in MmsValue_isDeletable.

Affected systems

libIEC61850 prior to 1.6.2

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade libIEC61850 to version 1.6.2 or later. If upgrading immediately is not possible, restrict untrusted network access to the MMS server port (typically TCP 102).

shell

$ git clone https://github.com/mz-automation/libiec61850.git && cd libiec61850 && git checkout v1.6.2 && mkdir build && cd build && cmake .. && make

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValue_getElement call returns NULL, and the sub-array branch passes that value to MmsValue_isDeletable, causing a NULL pointer dereference. A remote MMS Read request can therefore crash servers whose data models contain arrays, while the single-element error path handles the same invalid index safely. This issue is fixed in version 1.6.2.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-48741