Description

A vulnerability was found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function deleteDataSetValuesShadowBuffer of the file src/iec61850/server/mms_mapping/reporting.c of the component URCB Revalidation. The manipulation results in use after free. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 1.6.2 is sufficient to fix this issue. The patch is identified as 486fd57f3aed65bb9d636ff00f9ddce2e450b168. Upgrading the affected component is advised.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-06T22:16:55.057Z",
  "pubdate": "2026-08-06T22:16:55.057Z",
  "executiveSummary": "A use-after-free vulnerability has been identified in the MZ Automation libiec61850 library up to version 1.6.1, specifically within the URCB Revalidation component. The vulnerability resides in the deleteDataSetValuesShadowBuffer function located in src/iec61850/server/mms_mapping/reporting.c. This security defect arises from improper memory management during the handling of data set values shadow buffers.\nSuccessful exploitation of this flaw can result in memory corruption, potentially leading to application crashes or arbitrary code execution within the context of the running service. The attack requires local access to the target system to be successfully executed. Public exploits for this vulnerability are currently available, increasing the risk of active exploitation against vulnerable deployments. Organizations utilizing affected versions of the library face potential operational disruption and integrity risks if local threat actors leverage the publicly available exploit material.",
  "technicalDetails": "The vulnerability is classified as a Use After Free (UAF), occurring when a program continues to use a pointer after the memory allocation it references has been deallocated. The root cause is rooted in the deleteDataSetValuesShadowBuffer function within src/iec61850/server/mms_mapping/reporting.c, which fails to correctly nullify or manage object references after freeing the associated memory chunk in the URCB Revalidation component.\nThe affected software component is the URCB Revalidation mechanism in MZ Automation libiec61850 versions up to 1.6.1. Exploitation requires local access to the system hosting the vulnerable application. Depending on how the application processes inputs and manages internal states locally, an attacker can manipulate control flow or trigger memory corruption by causing the application to access the dangling pointer.\nThe step-by-step attack flow involves the following phases: first, the local attacker interacts with the vulnerable application or injects manipulated inputs that trigger the URCB Revalidation logic. Second, the execution flow invokes deleteDataSetValuesShadowBuffer, which deallocates the targeted shadow buffer memory without properly clearing references. Third, subsequent operations attempt to access the freed memory region, resulting in a use-after-free condition. Finally, if the memory has been reallocated by the system allocator, the attacker may achieve arbitrary read/write capabilities or cause a denial of service via application termination."
}