MZ Automation GmbH: Eight Libiec61850 Vulnerabilities Disclosed Together, Causing DoS
Key findings • Eight vulnerabilities disclosed simultaneously in MZ Automation GmbH's libiec61850 library on July 30, 2026. • Flaws primarily involve heap out-of-bounds reads due to improper …
Key findings
- Eight vulnerabilities disclosed simultaneously in MZ Automation GmbH's libiec61850 library on July 30, 2026.
- Flaws primarily involve heap out-of-bounds reads due to improper length and boundary checks in MMS and GOOSE protocol parsers.
- Successful exploitation can lead to denial-of-service conditions on affected devices.
- All vulnerabilities affect libiec61850 versions prior to 1.6.2; version 1.6.2 contains the patches.
- CISA has assigned CVSSv3 scores ranging from 6.5 (medium) to 7.5 (high) for these vulnerabilities.
On July 30, 2026, a batch of eight medium and high severity vulnerabilities was disclosed in MZ Automation GmbH's libiec61850 library. These vulnerabilities, all disclosed simultaneously, primarily stem from improper handling of buffer lengths and boundary conditions within various parsing and decoding components of the library. Successful exploitation could lead to denial-of-service conditions on affected devices.
Several vulnerabilities are related to the Message Specification (MMS) protocol parsing. CVE-2026-56758 affects the ACSE layer's processing of AARQ PDUs during MMS connection establishment, where an attacker-controlled length value can lead to a heap buffer overflow. CVE-2026-66349 involves a flaw in the MMS server connection handler's processing of BER-encoded request data, where a missing bounds check can cause a one-byte heap overflow. Additionally, CVE-2026-65421 and CVE-2026-63550 both relate to the MMS BER decoder; the former involves an unvalidated attacker-supplied length for fixed-width BER fields, leading to a heap buffer overflow and service termination, while the latter concerns improper processing of certain fields within confirmed-request messages, resulting in a heap out-of-bounds read.
The GOOSE (Generic Object Oriented Substation Event) protocol is also impacted by multiple flaws. CVE-2026-66369 describes an off-by-one boundary-handling flaw in the GOOSE parser triggered by a crafted Layer-2 multicast frame, leading to a heap out-of-bounds read. Similarly, CVE-2026-66364 points to a boundary handling flaw in the GOOSE payload parser, where an attacker-controlled inner element length exceeding its enclosing length causes an over-read. CVE-2026-66720 highlights an improper validation of the UTC timestamp field in GOOSE messages, which can trigger a heap out-of-bounds read.
Finally, CVE-2026-66360 affects the ISO Presentation layer, where a missing length check during normal mode negotiation allows a zero-length field to trigger a bounded heap over-read before MMS session establishment.
According to CISA, all these vulnerabilities affect versions of libiec61850 prior to 1.6.2. The patched version is 1.6.2. Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the device. Users are advised to update to the latest version to mitigate these risks.
This coordinated disclosure of eight vulnerabilities in libiec61850 underscores the importance of timely patching for industrial control system components. The consistent theme of boundary and length validation errors across different protocol layers highlights potential areas for focused security reviews in future development cycles. Users of MZ Automation GmbH products should prioritize updating to version 1.6.2 or later to address these issues.