MZ Automation libIEC61850 Multiple Memory Corruption Vulnerabilities
First seen Jul 25, 2026 · Updated Jul 25, 2026 · CVSS 9.2
MZ Automation's libIEC61850 library, widely used for IEC 61850 substation automation and protection communications, contains four vulnerabilities including stack- and heap-based buffer overflows and NULL pointer dereferences. An unauthenticated, network-adjacent attacker could exploit these flaws to crash critical protection and control services or achieve remote code execution, directly threatening energy, manufacturing, and transportation ICS environments.
Technical Analysis
CVE-2026-49035 is the most severe issue, a heap-based buffer overflow (CWE-122) triggered via a crafted MMS Initiate request, with demonstrated RCE when ASLR is disabled (CVSSv3 8.1, CVSSv4 9.2 Critical). CVE-2026-50039 is a stack-based buffer overflow (CWE-121) reachable via a malicious ReadRequest, causing memory corruption (CVSSv3 7.5). CVE-2026-50103 and CVE-2026-50032 are NULL pointer dereferences (CWE-476/228) in the GOOSE/R-GOOSE TLV parser and MMS Write Named Variable List handler respectively, each enabling denial-of-service crashes via malformed frames or empty listOfData fields. All flaws require only network adjacency and no authentication, making them attractive for disrupting substation protection, visibility, and control functions in OT environments. These vulnerabilities affect low-level ICS protocol libraries rather than AI/LLM agent frameworks, so there is no direct plausible impact to AI agent systems.
Affected Systems
MZ Automation libIEC61850 versions >=1.0.0 and <=1.6.1, used in IEC 61850-based substation automation, protection relays, and control systems across Critical Manufacturing, Energy, and Transportation Systems sectors worldwide.
Indicators of Compromise
- No known public exploitation reported; no specific IOCs (hashes, IPs, domains) published for these vulnerabilities.
Remediation Steps
- 1
Update libIEC61850
Upgrade to the latest build of libIEC61850 from the official MZ Automation GitHub repository (https://github.com/mz-automation/libiec61850), which addresses these vulnerabilities.
- 2
Network Segmentation
Isolate ICS/OT networks and control system devices from business networks and the internet, placing them behind firewalls.
- 3
Restrict Remote Access
Use VPNs or other secure remote access methods when interaction with these systems is required, and keep VPN software updated.
- 4
Monitor and Report
Monitor IEC 61850 traffic (MMS, GOOSE, R-GOOSE) for anomalous or malformed packets and report suspected malicious activity to CISA.
- 5
Risk Assessment
Perform impact analysis and risk assessment prior to deploying mitigations or patches in production ICS environments.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.