CVE-2026-57446

Name of the Vulnerable Software and Affected Versions libIEC61850 versions 1.6.1 through 1.6.1

Description A flaw exists in the MMS ObtainFile operation where a successful request closes the MmsObtainFileTask::fileHandle but retains a stale non-NULL value in a task marked MMS FILE UPLOAD STATE NOT USED. If a subsequent ObtainFile request reuses this task and the destination creation fails, the MMS FILE UPLOAD STATE SEND OBTAIN FILE ERROR DESTINATION cleanup process attempts to close the stale FILE object again. This can lead to a remote crash of servers that have the MMS file service and ObtainFile enabled.

Recommendations Update to version 1.6.2. As a temporary mitigation, disable the MMS file service or the ObtainFile operation.