CVE-2026-48741

Name of the Vulnerable Software and Affected Versions libIEC61850 versions prior to 1.6.2

Description The alternateArrayAccess function in src/mms/iso mms/server/mms read service.c fails to validate the alternate-access sub-array range when the numberOfElements variable is greater than zero. This leads to a situation where an out-of-range MmsValue getElement() call returns NULL, which is then passed to the MmsValue isDeletable() function, resulting in a NULL pointer dereference. A remote MMS Read request can trigger this condition to crash servers that utilize data models containing arrays.

Recommendations Update to version 1.6.2.