Description

A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiver_stopThreadless of the file src/sampled_values/sv_subscriber.c of the component ASDU Element Handler. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.2 is able to mitigate this issue. The patch is named a96bd674e0238276dd1387d31d52e55229d0771e. The affected component should be upgraded.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-07T14:16:59.020Z",
  "pubdate": "2026-08-07T14:16:59.020Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability has been identified in the MZ Automation libiec61850 library up to version 1.6.1. The flaw resides within the ASDU Element Handler component, specifically inside the SVReceiver_stopThreadless function located in src/sampled_values/sv_subscriber.c. Successful exploitation of this security defect allows a local attacker to corrupt heap memory through malicious input manipulation, potentially leading to arbitrary code execution or denial of service conditions.\nThe vulnerability requires local access to execute the exploit, and proof-of-concept exploit code has been publicly released, increasing the risk of active exploitation. The impact encompasses system compromise, application crashes, or memory corruption depending on the capabilities of the attacker and the runtime context of the affected process. Organizations utilizing the vulnerable library in industrial control systems or smart grid environments face elevated risks if systems remain unpatched.\nMitigation requires immediate action, specifically upgrading the affected component to version 1.6.2, which incorporates the official security patch identified by commit hash a96bd674e0238276dd1387d31d52e55229d0771e.",
  "technicalDetails": "The vulnerability is classified as a heap-based buffer overflow stemming from improper bounds checking or memory management within the ASDU Element Handler component of the MZ Automation libiec61850 library. The specific weakness is localized to the SVReceiver_stopThreadless function defined in the source file src/sampled_values/sv_subscriber.c.\nThe affected software versions include all releases of libiec61850 up to and including version 1.6.1. The flaw is triggered when an attacker with local positioning manipulates specific data structures or input parameters processed by the SVReceiver_stopThreadless function during the termination or handling of sampled values subscriber threads.\nDuring execution, the vulnerable function fails to adequately validate the size or boundaries of data written to or allocated within the heap memory buffer. When malicious input or unexpected state conditions are supplied, a write operation exceeds the boundaries of the allocated heap buffer, resulting in a heap-based buffer overflow. This corruption overwrites adjacent heap metadata or critical application data structures.\nAttack execution flow requires the attacker to be positioned locally on the host system where the libiec61850-based application is running. The attacker interacts with or supplies malformed data to the application, triggering the execution path through SVReceiver_stopThreadless in src/sampled_values/sv_subscriber.c. Upon triggering the vulnerable code path, the uncontrolled memory write occurs on the heap.\nDepending on the exact memory layout and heap architecture, post-exploitation impact ranges from application termination resulting in a denial of service to potential arbitrary code execution under the security context of the running process. The availability of public exploit materials lowers the barrier to entry for malicious actors seeking to leverage this heap corruption flaw."
}