CVE-2026-18582: libiec61850 Use-After-Free Vulnerability

CVE-2026-18582 Overview

CVE-2026-18582 affects the mz-automation/libiec61850 library up to version 1.6.1, an open-source implementation of the IEC 61850 protocol widely used in industrial control systems and electrical substation automation. The flaw resides in the Reporting_RCBWriteAccessHandler function within src/iec61850/server/mms_mapping/reporting.c, part of the Report Sending Path Handler component. An oversized RptID written to a Report Control Block (RCB) triggers a free of memory not located on the heap [CWE-590]. Remote attackers can trigger the condition without authentication, and a public exploit has been released.

Critical Impact
Remote unauthenticated attackers can cause invalid memory free operations in IEC 61850 servers, resulting in denial of service against industrial automation and substation control endpoints.

Affected Products

mz-automation libiec61850 versions up to and including 1.6.1
Industrial applications and IEDs (Intelligent Electronic Devices) embedding libiec61850 MMS server
Fixed in libiec61850 version 1.6.2

Discovery Timeline

2026-08-03 - CVE-2026-18582 published to NVD
2026-08-03 - Last updated in NVD database
Patch commit - 5b2a69f44256b8548927d8afdd7ac5f5381abe1e merged into mz-automation/libiec61850

Technical Details for CVE-2026-18582

Vulnerability Analysis

The vulnerability is classified as a Free of Memory Not on the Heap [CWE-590]. The Reporting_RCBWriteAccessHandler function processes write access requests to Report Control Block attributes over the Manufacturing Message Specification (MMS) protocol. When a client writes an oversized RptID value to an RCB, the handler enters a code path that ultimately calls free() on a pointer that does not reference heap-allocated memory. This invalid free corrupts allocator state and terminates the server process. Because IEC 61850 servers commonly run continuously on embedded controllers, an unauthenticated network attacker can disrupt substation communications by sending a single crafted MMS write request.

Root Cause

The reporting handler fails to validate the length of the incoming RptID string before applying pointer arithmetic and lifecycle management to the associated buffer. When a value exceeds the expected boundary, the code releases a pointer that references stack or static memory rather than a heap block, producing an invalid free. The fix in commit 5b2a69f44256b8548927d8afdd7ac5f5381abe1e corrects the buffer handling in reporting.c and adjacent MMS mapping code to prevent the invalid free.

Attack Vector

Exploitation requires network reachability to the MMS server port (typically TCP/102) and the ability to issue an MMS write request to a Report Control Block. IEC 61850 servers rarely require authentication for MMS write operations in default configurations, allowing any client with network access to trigger the fault. The attack causes the server to abort, disrupting monitoring and control traffic in substation networks. A public exploit has been released, according to VulDB.

// Patch excerpt from src/iec61850/server/mms_mapping/reporting.c
// Commit: 5b2a69f44256b8548927d8afdd7ac5f5381abe1e
// Fix: oversized RptID written to RCB can trigger invalid free
                 attributeToUpdate = trkInst->resv;
             else if (!strcmp(name, "DatSet"))
             {
-
                 char datSet[130];
                 const char* datSetStr = MmsValue_toString(newValue);

Source: GitHub Commit 5b2a69f

Detection Methods for CVE-2026-18582

Indicators of Compromise

Unexpected termination or restart of processes linking libiec61850 on industrial hosts
MMS write requests targeting Report Control Block RptID attributes with oversized string values
Repeated TCP connections to port 102 from untrusted sources followed by server disconnects
Core dumps referencing free() failures inside Reporting_RCBWriteAccessHandler or reporting.c

Detection Strategies

Inspect MMS traffic for write requests to RCB attributes with RptID payloads exceeding the vendor-defined length limits.
Alert on abnormal process crashes in IEC 61850 server binaries and correlate with recent inbound MMS sessions.
Deploy deep packet inspection on OT network segments to identify malformed MMS PDUs targeting reporting services.

Monitoring Recommendations

Enable process supervision on IEC 61850 servers to log every abnormal exit with timestamp and remote peer address.
Maintain network flow records for TCP/102 sessions and retain them long enough to reconstruct pre-crash activity.
Track library dependency versions across ICS assets to identify hosts still running libiec61850 1.6.1 or earlier.

How to Mitigate CVE-2026-18582

Immediate Actions Required

Upgrade libiec61850 to version 1.6.2 or later and rebuild all dependent applications and firmware images.
Restrict inbound access to MMS port TCP/102 on IEC 61850 servers to trusted engineering workstations and SCADA masters.
Audit ICS environments for embedded uses of libiec61850 that may not be under active vendor maintenance.
Review MMS server logs for prior crashes that may indicate exploitation attempts.

Patch Information

The fix is available in libiec61850 v1.6.2, delivered by commit 5b2a69f44256b8548927d8afdd7ac5f5381abe1e. Refer to the GitHub Security Advisory GHSA-7qg8-hm25-rv5v and the v1.6.2 release notes for upgrade guidance.

Workarounds

Place IEC 61850 servers behind an OT firewall that filters MMS traffic and enforces peer allowlists.
Disable client write access to Report Control Blocks where not required by the operational workflow.
Segment substation automation networks from corporate and remote-access networks using unidirectional gateways where feasible.

bash

# Example iptables rule restricting MMS access to a trusted SCADA master
iptables -A INPUT -p tcp --dport 102 -s 10.10.20.5 -j ACCEPT
iptables -A INPUT -p tcp --dport 102 -j DROP