Scu_1Cp

A heap-based buffer overflow exists in the MMS Protocol Workflow component within the `MmsMapping varAccessSpecToObjectReference()` function located in the `src/iec61850/common/iec61850 common.c` file. This issue occurs when the `GetNamedVariableListAttributesResponse.itemId` argument is manipulated, requiring local access to execute the attack.

A heap-based buffer overflow exists in the ASDU Element Handler component within the `SVReceiver stopThreadless()` function located in the `src/sampled values/sv subscriber.c` file. This issue allows a local attacker to trigger the overflow through specific manipulation.

A use after free issue exists in the URCB Revalidation component within the `deleteDataSetValuesShadowBuffer()` function located in the src/iec61850/server/mms mapping/reporting.c file. This flaw allows for local manipulation of the system.

A heap-based buffer overflow occurs in the `UA Client readNodeClassAttribute()` function within the `src/client/ua client highlevel.c` file. This issue requires local access to be exploited.

A use after free issue exists in the `UA Client getRemoteDataTypes()` function within the examples/custom datatype/client types custom.c file. A use after free occurs when a program continues to use a pointer after it has been freed, which can lead to crashes or arbitrary code execution. This issue can be exploited by a local attacker.