CVE-2026-18583: libiec61850 Buffer Overflow Vulnerability

CVE-2026-18583 Overview

CVE-2026-18583 is an out-of-bounds read vulnerability in mz-automation libiec61850 versions up to and including 1.6.1. The flaw resides in the checkDataSetAccess function within src/iec61850/server/mms_mapping/mms_mapping.c, part of the MMS Request Handler component. An attacker can trigger the condition remotely by sending a crafted MMS request without authentication or user interaction. A public exploit exists, and the vendor has released 1.6.2 to address the issue via patch commit 062062daf4cb50c7aa76e01d6fb4d58fc9278a7d. The vulnerability is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Critical Impact
Remote, unauthenticated attackers can trigger an out-of-bounds read in the MMS server, causing information exposure or a potential crash of the IEC 61850 service used across substation automation and industrial control environments.

Affected Products

mz-automation libiec61850 versions up to and including 1.6.1
Component: MMS Request Handler (src/iec61850/server/mms_mapping/mms_mapping.c)
Function: checkDataSetAccess

Discovery Timeline

2026-08-03 - CVE-2026-18583 published to NVD
2026-08-03 - Last updated in NVD database
Patch commit - 062062daf4cb50c7aa76e01d6fb4d58fc9278a7d released in version 1.6.2

Technical Details for CVE-2026-18583

Vulnerability Analysis

The libiec61850 library implements the IEC 61850 protocol suite widely used in electrical substation automation. The MMS (Manufacturing Message Specification) server component handles requests over TCP, including data set access checks. In checkDataSetAccess, the code constructs a data set reference by copying a client-supplied listName string into a fixed-size stack buffer using StringUtils_copyStringToBuffer, which does not enforce a length limit. When an attacker sends an association-specific, VMD-specific, or domain-specific list name that exceeds the target buffer, the routine reads past allocated memory during subsequent processing. This causes an out-of-bounds read that can leak adjacent memory contents or crash the MMS handler.

Root Cause

The root cause is the use of an unbounded string copy primitive on attacker-controlled input inside the access control handler. The vulnerable routine assumed the caller-supplied name would fit within the destination buffer. Because MMS clients may negotiate arbitrary object names in association-specific and VMD-specific request paths, no length validation existed prior to the buffer copy. The patch replaces StringUtils_copyStringToBuffer with StringUtils_copyStringMax, enforcing a 129-byte cap that matches the buffer size.

Attack Vector

Exploitation requires network access to the MMS/TCP port exposed by an IEC 61850 server built on the vulnerable library. No credentials or user interaction are needed. An attacker sends a malformed MMS request containing an oversized list identifier that flows into checkDataSetAccess. Publicly available exploit code targets this path.

         if (listType == MMS_ASSOCIATION_SPECIFIC)
         {
             dataSetRef[0] = '@';
-            StringUtils_copyStringToBuffer(dataSetRef + 1, listName);
+            StringUtils_copyStringMax(dataSetRef + 1, 129, listName);
         }
         else if (listType == MMS_VMD_SPECIFIC)
         {
-            StringUtils_copyStringToBuffer(dataSetRef, listName);
+            StringUtils_copyStringMax(dataSetRef, 129, listName);
         }
         else if (listType == MMS_DOMAIN_SPECIFIC)
         {

Source: GitHub Commit 062062daf4cb50c7aa76e01d6fb4d58fc9278a7d. The patch swaps the unbounded copy for a length-limited variant that constrains input to the destination buffer size.

Detection Methods for CVE-2026-18583

Indicators of Compromise

Unexpected termination or restarts of the MMS server process on IEC 61850 devices or gateways.
Inbound MMS/TCP connections (default port 102) from unrecognized source addresses containing abnormally long object or data set names.
Malformed or oversized getNameList or data set access requests captured in packet traces.

Detection Strategies

Deploy protocol-aware inspection for MMS traffic and alert on list name fields exceeding the 128-character IEC 61850 limit.
Monitor server logs for repeated access control check failures or abnormal disconnects tied to checkDataSetAccess.
Correlate crash events on OT hosts with preceding MMS session activity to identify exploitation attempts.

Monitoring Recommendations

Capture full-packet telemetry on segments carrying MMS traffic and retain for offline analysis.
Track process availability metrics for libiec61850-based services and alert on unexpected restarts.
Review firewall logs for MMS connections originating outside authorized engineering workstations or SCADA hosts.

How to Mitigate CVE-2026-18583

Immediate Actions Required

Upgrade libiec61850 to version 1.6.2 or later, which contains patch commit 062062daf4cb50c7aa76e01d6fb4d58fc9278a7d.
Inventory embedded devices, gateways, and applications that link against libiec61850 to identify unpatched instances.
Restrict MMS/TCP port 102 at the network perimeter and OT firewall to authorized client addresses only.

Patch Information

Upstream fix is available in the GitHub Release v1.6.2. Details are published in GitHub Security Advisory GHSA-7v2x-39mw-2979. Additional context is available in VulDB CVE-2026-18583. Downstream vendors that redistribute libiec61850 should rebuild firmware and applications with the updated library.

Workarounds

Segment IEC 61850 servers into isolated OT VLANs and enforce allow-listed peer addresses on the MMS port.
Terminate MMS sessions at a protocol-aware gateway that validates object name lengths before forwarding traffic.
Disable MMS services on devices where the protocol is not required by operations.

bash

# Example: restrict MMS port 102 to specific SCADA clients using iptables
iptables -A INPUT -p tcp --dport 102 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 102 -j DROP

# Verify installed libiec61850 version after upgrade
grep LIBIEC61850_VERSION /usr/local/include/libiec61850/hal/version.h