{"id":"CVE-2026-57446","kind":"vulnerability","aliases":["CVE-2026-57446"],"related":[],"title":"libIEC61850: double-close of a file handle lets remote clients crash servers","description":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle but leaves the stale non-NULL value in a task marked MMS_FILE_UPLOAD_STATE_NOT_USED. If a later ObtainFile request reuses that task and destination creation fails, MMS_FILE_UPLOAD_STATE_SEND_OBTAIN_FILE_ERROR_DESTINATION cleanup closes the stale FILE object again. Servers with the MMS file service and ObtainFile enabled can therefore be crashed remotely by the success-then-failure request sequence. This issue is fixed in version 1.6.2.","summary":"libIEC61850 versions 1.6.1 through 1.6.2 close a file handle twice after a crafted sequence of MMS ObtainFile requests. A remote client can crash a server that has the MMS file service and ObtainFile enabled.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["energy","iec-61850","industrial-control","libiec61850","package","scada"],"not_affected_if":["default-config","no-mms-file-service"],"how_to_check":"- Check the libIEC61850 version in the build or in the vendored source; affected versions are 1.6.1 up to but not including `1.6.2`.\n- Check whether the server enables the MMS file service and ObtainFile handling in its configuration (unknown which setting name the sources use).","fix":"- Upgrade libIEC61850 to `1.6.2` or later.","status":"open","published_at":"2026-10-16T16:18:44+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:27:16+00:00","updated_at":"2026-10-25T04:27:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:27:16Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade libIEC61850 to `1.6.2` or later.","reach":"network","title":"libIEC61850: double-close of a file handle lets remote clients crash servers","impact":"low","summary":"libIEC61850 versions 1.6.1 through 1.6.2 close a file handle twice after a crafted sequence of MMS ObtainFile requests. A remote client can crash a server that has the MMS file service and ObtainFile enabled.","category":"package","nicknames":[],"who_cares":["libiec61850","iec-61850","energy","scada","industrial-control"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote clients crash the server process, causing denial of service.","analyst_note":"Confirm whether the sources or NVD name the exact configuration option that enables MMS file services and whether authentication is required to send ObtainFile requests.","how_to_check":"- Check the libIEC61850 version in the build or in the vendored source; affected versions are 1.6.1 up to but not including `1.6.2`.\n- Check whether the server enables the MMS file service and ObtainFile handling in its configuration (unknown which setting name the sources use).","needs_analyst":true,"not_affected_if":["default-config","no-mms-file-service"],"who_is_affected":"Applications that embed libIEC61850 as an IEC 61850 server with the MMS file service and ObtainFile enabled are exposed to remote crashes. Clients only, or servers without the MMS file service, are not affected by this flaw as described.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000631,"input_tokens":3513,"output_tokens":560,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-57446':16A,19A '-61850':22B '1.6.1':31B,87C '1.6.2':33B,89C,172C '61850':72C 'cleanup':137C 'client':11A,49B,73C 'close':4A,34B,95C,138C 'control':25B 'craft':41B 'crash':12A,51B,156C 'creation':126C 'cve':14A,17A 'destin':125C,136C 'doubl':3A 'double-clos':2A 'enabl':62B,152C 'energi':20B 'error':135C 'fail':127C 'failur':163C 'file':7A,36B,58B,111C,129C,134C,141C,148C 'filehandl':97C 'fix':169C 'goos':79C 'handl':8A,37B 'iec':21B,71C 'implement':69C 'includ':77C 'industri':24B 'industrial-control':23B 'issu':167C 'later':118C 'leav':99C 'let':9A 'libiec61850':1A,26B,29B,63C 'mark':109C 'mms':44B,57B,78C,92C,110C,128C,147C 'mmsobtainfiletask':96C 'non':103C 'non-nul':102C 'null':104C 'object':142C 'obtain':133C 'obtainfil':45B,61B,93C,119C,151C 'open':67C 'open-sourc':66C 'oper':94C 'packag':27B 'protocol':76C 'r':84C 'r-session':83C 'remot':10A,48B,157C 'request':46B,120C,164C 'reus':121C 'sampl':80C 'scada':28B 'send':132C 'sequenc':42B,165C 'server':13A,53B,75C,144C 'servic':59B,149C 'session':85C 'sourc':68C 'stale':101C,140C 'state':113C,131C 'success':91C,161C 'success-then-failur':160C 'task':108C,123C 'therefor':154C 'twice':38B 'upload':112C,130C 'use':115C 'valu':81C,105C 'version':30B,171C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed libIEC61850 as an IEC 61850 server with the MMS file service and ObtainFile enabled are exposed to remote crashes. Clients only, or servers without the MMS file service, are not affected by this flaw as described.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T16:18:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57446","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57446","severity":null,"published_at":"2026-10-16T16:18:44+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}