{"id":"CVE-2026-68908","kind":"vulnerability","aliases":["CVE-2026-68908"],"related":[],"title":"libIEC61850: oversized report ID write crashes server via invalid free","description":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, Reporting_RCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes sendNextReportEntrySegment to serialize the report, the function wraps rptIdBuf[130] as a temporary MmsValue and passes it to MmsValue_setVisibleString. The setter's resize path frees the stack-backed buffer, allowing a remote client to trigger an invalid free and server crash by writing the oversized RptID and then generating a report. This issue is fixed in version 1.6.2.","summary":"libIEC61850 is an open-source IEC 61850 client and server library. Before version 1.6.2, a remote client can write an RptID longer than 129 bytes, and a later report generation frees a stack-backed buffer, causing an invalid free and a server crash.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","energy-automation","iec-61850","industrial-control","libiec61850","package"],"not_affected_if":["client-only-use","library-version-1.6.2-or-later"],"how_to_check":"- Check the libIEC61850 version in use, for example with `grep -r libiec61850` in build files or `pkg-config --modversion iec61850`\n- Confirm whether the server exposes MMS report control blocks to remote clients (the write path requires a connected client)","fix":"- Upgrade libIEC61850 to `1.6.2` or later","status":"open","published_at":"2026-10-16T16:20:01+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:27:15+00:00","updated_at":"2026-10-25T04:27:15+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:27:15Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade libIEC61850 to `1.6.2` or later","reach":"network","title":"libIEC61850: oversized report ID write crashes server via invalid free","impact":"medium","summary":"libIEC61850 is an open-source IEC 61850 client and server library. Before version 1.6.2, a remote client can write an RptID longer than 129 bytes, and a later report generation frees a stack-backed buffer, causing an invalid free and a server crash.","category":"package","nicknames":[],"who_cares":["libiec61850","iec-61850","industrial-control","energy-automation","c"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote client crashes the server process via invalid memory free","analyst_note":"","how_to_check":"- Check the libIEC61850 version in use, for example with `grep -r libiec61850` in build files or `pkg-config --modversion iec61850`\n- Confirm whether the server exposes MMS report control blocks to remote clients (the write path requires a connected client)","needs_analyst":false,"not_affected_if":["library-version-1.6.2-or-later","client-only-use"],"who_is_affected":"Teams running an IEC 61850 server built on libIEC61850 older than 1.6.2 that accepts MMS connections from remote clients. Systems that only use the library as a client, or that do not expose report control blocks over the network, are less exposed. The sources do not say whether a default configuration is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000615,"input_tokens":3472,"output_tokens":535,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-61850':22B '-68908':13A,16A '1.6.2':42B,98C,179C '129':52B,106C '130':129C '61850':35B,82C 'accept':101C 'allow':151C 'autom':20B 'back':63B,149C 'block':113C 'buffer':64B,150C 'byte':53B,107C 'c':17B 'caus':65B,119C 'client':36B,45B,83C,154C 'control':25B,112C 'crash':6A,72B,162C 'cve':11A,14A 'energi':19B 'energy-autom':18B 'fix':176C 'free':10A,59B,68B,145C,159C 'function':126C 'generat':58B,170C 'gi':117C 'goos':89C 'id':4A 'iec':21B,34B,81C 'implement':79C 'includ':87C 'industri':24B 'industrial-control':23B 'invalid':9A,67B,158C 'issu':174C 'later':56B,118C 'libiec61850':1A,26B,28B,73C 'librari':39B 'longer':50B,104C 'mms':88C 'mmsvalu':133C,138C 'open':32B,77C 'open-sourc':31B,76C 'overs':2A,166C 'packag':27B 'pass':135C 'path':115C,144C 'prior':96C 'protocol':86C 'r':94C 'r-session':93C 'rcbwriteaccesshandl':100C 'remot':44B,153C 'report':3A,57B,99C,111C,124C,172C 'report-control-block':110C 'resiz':143C 'rptid':49B,103C,167C 'rptidbuf':128C 'sampl':90C 'sendnextreportentryseg':120C 'serial':122C 'server':7A,38B,71B,85C,161C 'session':95C 'setter':141C 'setvisiblestr':139C 'sourc':33B,78C 'stack':62B,148C 'stack-back':61B,147C 'temporari':132C 'trigger':156C 'valu':91C 'version':41B,178C 'via':8A 'wrap':127C 'write':5A,47B,114C,164C","nicknames":[],"mitigations":[],"who_affected":"Teams running an IEC 61850 server built on libIEC61850 older than 1.6.2 that accepts MMS connections from remote clients. Systems that only use the library as a client, or that do not expose report control blocks over the network, are less exposed. The sources do not say whether a default configuration is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T16:20:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68908","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68908","severity":null,"published_at":"2026-10-16T16:20:01+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}