{"id":"CVE-2026-68907","kind":"vulnerability","aliases":["CVE-2026-68907"],"related":[],"title":"libIEC61850: stack over-read in dataset handling lets remote crash servers","description":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtils_copyStringToBuffer while constructing an MMS_ASSOCIATION_SPECIFIC dataset reference. The helper treats uninitialized dataSetRef[130] storage as a source string, causing strlen to read beyond the stack buffer, and then copies those bytes into the caller-owned listName buffer. A remote defineNamedVariableList request can crash servers that have dynamic dataset service enabled and a dataset access handler installed; the advisory also observes caller stack corruption but establishes denial of service as the primary impact. This issue is fixed in version 1.6.2.","summary":"libIEC61850 is an open-source library implementing IEC 61850 client and server protocols. Before 1.6.2, a remote defineNamedVariableList request triggers a stack over-read that can crash the server and may corrupt caller stack memory.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["energy","iec-61850","industrial-control","libiec61850","package","scada","substation"],"not_affected_if":["client-only","dynamic-dataset-disabled"],"how_to_check":"- Check the libIEC61850 version in use: `unknown` for exact command, look for the library version in your build or package manifest\n- Confirm whether the server enables dynamic dataset service and installs a dataset access handler; the sources do not give a config key name","fix":"- Upgrade libIEC61850 to `1.6.2` or later","status":"open","published_at":"2026-10-16T16:20:00+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:04:29+00:00","updated_at":"2026-10-25T03:04:29+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:04:29Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade libIEC61850 to `1.6.2` or later","reach":"network","title":"libIEC61850: stack over-read in dataset handling lets remote crash servers","impact":"medium","summary":"libIEC61850 is an open-source library implementing IEC 61850 client and server protocols. Before 1.6.2, a remote defineNamedVariableList request triggers a stack over-read that can crash the server and may corrupt caller stack memory.","category":"package","nicknames":[],"who_cares":["libiec61850","iec-61850","energy","substation","scada","industrial-control"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Remote request crashes the server, possibly corrupting caller stack memory","analyst_note":"Check the NVD entry and upstream advisory for the exact configuration trigger and whether stack corruption can lead to code execution.","how_to_check":"- Check the libIEC61850 version in use: `unknown` for exact command, look for the library version in your build or package manifest\n- Confirm whether the server enables dynamic dataset service and installs a dataset access handler; the sources do not give a config key name","needs_analyst":true,"not_affected_if":["client-only","dynamic-dataset-disabled"],"who_is_affected":"Systems running libIEC61850 before 1.6.2 as an IEC 61850 MMS server with dynamic dataset service enabled and a dataset access handler installed are exposed to a remote crash. Clients-only deployments and servers without dynamic dataset service are not described as affected; the sources do not say more.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000638,"input_tokens":3506,"output_tokens":574,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-61850':21B '-68907':15A,18A '1.6.2':44B,91C,182C '130':115C '61850':38B,75C 'access':157C 'advisori':161C 'also':162C 'argument':98C 'associ':106C 'beyond':125C 'buffer':128C,140C 'byte':133C 'caller':63B,137C,164C 'caller-own':136C 'caus':121C 'checkdatasetaccess':92C 'client':39B,76C 'construct':103C 'control':24B 'copi':131C 'copystringtobuff':101C 'corrupt':62B,166C 'crash':11A,57B,146C 'cve':13A,16A 'dataset':7A,108C,151C,156C 'datasetref':114C 'definenamedvariablelist':47B,143C 'denial':169C 'destin':97C 'dynam':150C 'enabl':153C 'energi':19B 'establish':168C 'fix':179C 'goos':82C 'handl':8A 'handler':158C 'helper':111C 'iec':20B,37B,74C 'impact':175C 'implement':36B,72C 'includ':80C 'industri':23B 'industrial-control':22B 'instal':159C 'issu':177C 'let':9A 'libiec61850':1A,25B,29B,66C 'librari':35B 'listnam':139C 'may':61B 'memori':65B 'mms':81C,105C 'observ':163C 'open':33B,70C 'open-sourc':32B,69C 'over-read':3A,52B 'own':138C 'packag':26B 'primari':174C 'prior':89C 'protocol':42B,79C 'r':87C 'r-session':86C 'read':5A,54B,124C 'refer':109C 'remot':10A,46B,142C 'request':48B,144C 'revers':93C 'sampl':83C 'scada':27B 'server':12A,41B,59B,78C,147C 'servic':152C,171C 'session':88C 'sourc':34B,71C,95C,119C 'specif':107C 'stack':2A,51B,64B,127C,165C 'storag':116C 'string':120C 'stringutil':100C 'strlen':122C 'substat':28B 'treat':112C 'trigger':49B 'uniniti':113C 'valu':84C 'version':181C","nicknames":[],"mitigations":[],"who_affected":"Systems running libIEC61850 before 1.6.2 as an IEC 61850 MMS server with dynamic dataset service enabled and a dataset access handler installed are exposed to a remote crash. Clients-only deployments and servers without dynamic dataset service are not described as affected; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T16:20:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68907","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68907","severity":null,"published_at":"2026-10-16T16:20:00+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}