PT-2026-115645 · Unknown · Libiec61850
CVE-2026-68906
·
Published
2026-10-16
·
Updated
2026-10-16
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
libIEC61850 versions prior to 1.6.2
Description
The
parseUserInformation() function in src/mms/iso acse/acse.c fails to properly validate the negative bufPos returned by BerDecoder decodeLength() for truncated long-form lengths, checking for zero instead. This allows an unauthenticated remote peer to send a malformed AARE PDU (Application Association Request) during association, leading to an infinite CPU loop or a one-byte out-of-bounds read and process abort if the preceding byte is inaccessible.Recommendations
Update to version 1.6.2.
Exploit
Fix
Out of bounds Read
Infinite Loop
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Libiec61850