Vulnerability · Published Jul 30, 2026 · Assigned by icscert
CVE-2026-65421MZ Automation libiec61850 Out-of-bounds Read
Medium 6.5
In plain English
A medium-severity out-of-bounds read in libiec61850 from MZ Automation GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 78.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean/integer): an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-service condition.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MZ Automation GmbH | libiec61850 | 0 – before 1.6.2 |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H