Live › vulnerability › CVE-2026-68908
Go to dashboardlibIEC61850 is an open-source IEC 61850 client and server library. Before version 1.6.2, a remote client can write an RptID longer than 129 bytes, and a later report generation frees a stack-backed buffer, causing an invalid free and a server crash.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running an IEC 61850 server built on libIEC61850 older than 1.6.2 that accepts MMS connections from remote clients. Systems that only use the library as a client, or that do not expose report control blocks over the network, are less exposed. The sources do not say whether a default configuration is affected.
No product ranges from the sources yet.
grep -r libiec61850 in build files or pkg-config --modversion iec618501.6.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, Reporting_RCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes sendNextReportEntrySegment to serialize the report, the function wraps rptIdBuf[130] as a temporary MmsValue and passes it to MmsValue_setVisibleString. The setter's resize path frees the stack-backed buffer, allowing a remote client to trigger an invalid free and server crash by writing the oversized RptID and then generating a report. This issue is fixed in version 1.6.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-68908")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.