CVE-2026-68906

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/isoacse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoderdecodeLength fo...

CVE-2026-68906

The libIEC61850 open-source implementation of IEC 61850 protocols is vulnerable to an infinite loop and out-of-bounds read in the parseUserInformation function located in src/mms/iso_acse/acse.c. The root cause is a failure to properly validate the negative bufPos returned by BerDecoder_decodeLen...

CVE-2026-68906

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/isoacse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoderdecodeLength fo...

CVE-2026-68906 libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDU

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/isoacse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoderdecodeLength fo...

CVE-2026-68906 libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDU

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/isoacse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoderdecodeLength fo...

CVE-2026-68906 libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDU

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/isoacse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoderdecodeLength fo...

CVE-2026-68906: Out-of-bounds Read

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/isoacse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoderdecodeLength fo...

PT-2026-115645

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso acse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoder decodeLength...

MZ Automation GmbH libiec61850 buffer error vulnerability

MZ Automation GmbH’s libiec61850 versions prior to 1.6.2 have a security vulnerability. This vulnerability stems from the parseUserInformation function, which checks if len is zero before verifying the returned negative bufPos. As a result, errors are ignored, and the buffer-1 is read, leading to...