Live › vulnerability › CVE-2026-68906
Go to dashboardA malformed association response (AARE) sent to libIEC61850 during connection setup makes the parser loop forever on the CPU, or read one byte before a buffer and abort the process. An unauthenticated remote peer can trigger it, so a client or server exposed to the network can be stalled or crashed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the libIEC61850 version in your build or package manifest: unknown if the sources do not say which packages embed it.
Upgrade libIEC61850 to 1.6.2 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path therefore swallows the error, reads buffer[-1], resets parsing to the beginning, and repeats the same malformed state. An unauthenticated remote peer can send a malformed AARE PDU during association to cause an infinite CPU loop under a normal allocator or a one-byte out-of-bounds read and process abort when the preceding byte is inaccessible. This issue is fixed in version 1.6.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-68906")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.