CVE-2026-19206: libiec61850 Buffer Overflow Vulnerability

CVE-2026-19206 Overview

CVE-2026-19206 is a heap-based buffer overflow vulnerability in MZ Automation libiec61850 versions up to 1.6.1. The flaw resides in the SVReceiver_stopThreadless function within src/sampled_values/sv_subscriber.c, part of the ASDU Element Handler component. An attacker with local access and low privileges can manipulate ASDU element handling to trigger the overflow. Public exploit code has been released, increasing the likelihood of opportunistic abuse against IEC 61850 sampled values subscriber implementations. The maintainer released version 1.6.2 containing patch commit a96bd674e0238276dd1387d31d52e55229d0771e to resolve the missing length validation. The weakness is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Critical Impact
A local attacker can trigger a heap-based buffer overflow in the IEC 61850 Sampled Values (SV) subscriber, potentially corrupting memory in industrial automation processes that consume SV messages.

Affected Products

MZ Automation libiec61850 versions up to and including 1.6.1
The SVReceiver_stopThreadless function in src/sampled_values/sv_subscriber.c
ASDU Element Handler component processing Sampled Values messages

Discovery Timeline

2026-08-07 - CVE-2026-19206 published to NVD
2026-08-12 - Last updated in NVD database
Patch commit - a96bd674e0238276dd1387d31d52e55229d0771e released in libiec61850 v1.6.2

Technical Details for CVE-2026-19206

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in the Sampled Values (SV) subscriber implementation of libiec61850, an open-source library implementing the IEC 61850 protocol suite used in electrical substation automation. The defect occurs when the ASDU (Application Service Data Unit) element handler processes fields without validating their declared length against buffer boundaries. Public exploit code exists, but the attack requires local access with low privileges and yields limited confidentiality, integrity, and availability impact within a single process scope. The weakness maps to [CWE-119], improper restriction of operations within the bounds of a memory buffer.

Root Cause

The patch commit message describes the fix as "SV subscriber: fixed missing length validation of some ASDU elements." The parseASDU code path in src/sampled_values/sv_subscriber.c accepted length values from received ASDU fields without confirming they matched expected sizes or fit within allocated heap buffers. An oversized or malformed field could therefore be copied beyond the destination boundary, corrupting adjacent heap metadata or objects.

Attack Vector

Exploitation requires local delivery of a crafted SV frame to a vulnerable subscriber process. Because IEC 61850 SV messages are typically multicast Ethernet frames on a substation LAN, the practical attack surface depends on network exposure of the process station bus. An adversary already positioned on the same segment as the receiver can send malformed ASDU elements to trigger the overflow.

     self->running = false;
 }
 
+static void
+invalidFieldSize(const char* fieldName, int expectedSize, int actualSize)
+{
+    if (DEBUG_SV_SUBSCRIBER)
+        printf("SV_SUBSCRIBER: Invalid %s size: expected %d, got %d\n", fieldName, expectedSize, actualSize);
+}
+
+static void
+fieldTooLong(const char* fieldName, int maxSize, int actualSize)
+{
+    if (DEBUG_SV_SUBSCRIBER)
+        printf("SV_SUBSCRIBER: %s too long: max %d, got %d\n", fieldName, maxSize, actualSize);
+}
+
 static void
 parseASDU(SVReceiver self, SVSubscriber subscriber, uint8_t* buffer, int length)
 {

Source: GitHub Commit a96bd674. The patch adds invalidFieldSize and fieldTooLong helper routines invoked from parseASDU to reject ASDU elements whose declared length does not match the expected size or exceeds the maximum permitted length.

Detection Methods for CVE-2026-19206

Indicators of Compromise

Unexpected crashes or SIGSEGV signals in processes linking against libiec61850 up to version 1.6.1, especially those consuming Sampled Values traffic.
Malformed IEC 61850-9-2 SV frames on the station bus with ASDU element length fields inconsistent with element type.
Heap corruption traces or ASan reports referencing parseASDU or SVReceiver_stopThreadless in application logs.

Detection Strategies

Inventory installed versions of libiec61850 across substation gateways, IEDs, and HMI hosts, flagging any build at or below 1.6.1.
Deploy network monitoring on process bus VLANs to detect anomalous SV frame sizes or ASDU field length mismatches.
Enable core dump collection on host processes that link the library so crashes can be triaged against this CVE.

Monitoring Recommendations

Alert on process termination or restart events for services parsing SV multicast traffic.
Correlate host crash telemetry with capture of concurrent SV frames on the station bus for post-incident analysis.
Track library and firmware versions on operational technology assets through an OT asset management workflow.

How to Mitigate CVE-2026-19206

Immediate Actions Required

Upgrade libiec61850 to version 1.6.2 or later on all systems that link the library.
Rebuild and redeploy vendor firmware or applications that statically link an affected version of libiec61850.
Restrict access to process bus and station bus network segments to authorized IEDs and engineering workstations only.

Patch Information

The fix is delivered in libiec61850 v1.6.2. The relevant change is commit a96bd674e0238276dd1387d31d52e55229d0771e, which introduces length validation for ASDU elements in src/sampled_values/sv_subscriber.c. Details of the report are tracked in GitHub Issue #598 and VulDB entry #386950.

Workarounds

Segment process bus traffic on isolated VLANs and enforce Layer 2 access control to prevent unauthorized SV publishers.
Disable the SV subscriber component in applications that do not require IEC 61850-9-2 processing until the patched library is deployed.
Apply host-level exploit mitigations such as heap hardening and ASLR to raise the cost of successful exploitation on affected endpoints.

bash

# Verify installed libiec61850 version and upgrade to 1.6.2
git clone https://github.com/mz-automation/libiec61850.git
cd libiec61850
git checkout v1.6.2
make
sudo make install