{"id":"CVE-2026-68906","kind":"vulnerability","aliases":["CVE-2026-68906"],"related":[],"title":"libIEC61850: malformed ACSE packet causes infinite loop or crash","description":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path therefore swallows the error, reads buffer[-1], resets parsing to the beginning, and repeats the same malformed state. An unauthenticated remote peer can send a malformed AARE PDU during association to cause an infinite CPU loop under a normal allocator or a one-byte out-of-bounds read and process abort when the preceding byte is inaccessible. This issue is fixed in version 1.6.2.","summary":"A malformed association response (AARE) sent to libIEC61850 during connection setup makes the parser loop forever on the CPU, or read one byte before a buffer and abort the process. An unauthenticated remote peer can trigger it, so a client or server exposed to the network can be stalled or crashed.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","energy","iec-61850","libiec61850","package","scada"],"not_affected_if":["version-1.6.2-or-later"],"how_to_check":"Check the libIEC61850 version in your build or package manifest: unknown if the sources do not say which packages embed it.","fix":"Upgrade libIEC61850 to 1.6.2 or later.","status":"open","published_at":"2026-10-16T16:20:00+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:39:05+00:00","updated_at":"2026-10-23T22:39:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:39:05Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade libIEC61850 to 1.6.2 or later.","reach":"network","title":"libIEC61850: malformed ACSE packet causes infinite loop or crash","impact":"low","summary":"A malformed association response (AARE) sent to libIEC61850 during connection setup makes the parser loop forever on the CPU, or read one byte before a buffer and abort the process. An unauthenticated remote peer can trigger it, so a client or server exposed to the network can be stalled or crashed.","category":"package","who_cares":["libiec61850","iec-61850","scada","energy","embedded"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote peer stalls the process at 100% CPU or crashes it","analyst_note":"","how_to_check":"Check the libIEC61850 version in your build or package manifest: unknown if the sources do not say which packages embed it.","needs_analyst":false,"not_affected_if":["version-1.6.2-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000496,"input_tokens":3082,"output_tokens":375,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1':132C '-2026':11A,14A '-61850':19B '-68906':12A,15A '1.6.2':99C,191C '61850':83C 'aar':27B,152C 'abort':50B,178C 'acs':3A 'alloc':165C 'associ':25B,155C 'begin':137C 'berdecod':114C 'bound':174C 'buffer':48B,131C 'bufpo':111C 'byte':45B,170C,182C 'caus':5A,157C 'check':103C 'client':62B,84C 'connect':32B 'continu':124C 'cpu':41B,160C 'crash':9A,73B 'cve':10A,13A 'decodelength':115C 'embed':16B 'energi':17B 'error':129C 'expos':65B 'fix':188C 'forev':38B 'form':121C 'goos':90C 'iec':18B,82C 'implement':80C 'inaccess':184C 'includ':88C 'infinit':6A,159C 'issu':186C 'len':104C 'length':122C 'libiec61850':1A,20B,30B,74C 'long':120C 'long-form':119C 'loop':7A,37B,161C 'make':34B 'malform':2A,24B,142C,151C 'mms':89C 'negat':110C 'network':68B 'normal':164C 'one':44B,169C 'one-byt':168C 'open':78C 'open-sourc':77C 'out-of-bound':171C 'packag':21B 'packet':4A 'pars':134C 'parser':36B 'parseuserinform':100C 'path':125C 'pdu':153C 'peer':56B,147C 'preced':181C 'prior':97C 'process':52B,177C 'protocol':87C 'r':95C 'r-session':94C 'read':43B,130C,175C 'remot':55B,146C 'repeat':139C 'reset':133C 'respons':26B 'return':112C 'sampl':91C 'scada':22B 'send':149C 'sent':28B 'server':64B,86C 'session':96C 'setup':33B 'sourc':79C 'src/mms/iso_acse/acse.c':102C 'stall':71B 'state':143C 'swallow':127C 'therefor':126C 'trigger':58B 'truncat':118C 'unauthent':54B,145C 'valid':108C 'valu':92C 'version':190C 'zero':106C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T16:20:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68906","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68906","severity":null,"published_at":"2026-10-16T16:20:00+00:00","modified_at":"2026-10-19T13:16:58+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}