CVE-2026-51219: lib60870 Buffer Overflow Vulnerability

CVE-2026-51219 Overview

CVE-2026-51219 is a heap buffer overflow vulnerability in the HighPriorityASDUQueue_hasUnconfirmedIMessages function of lib60870, an open-source implementation of the IEC 60870-5-101/104 industrial communication protocols. Affected versions include v2.3.3 through v2.3.6. An attacker can trigger the flaw by delivering a crafted payload to a vulnerable process, causing a Denial of Service (DoS) condition. The library is commonly used in supervisory control and data acquisition (SCADA) and industrial control system (ICS) deployments, making disruption of the service consequential to operational technology environments. The weakness is classified under CWE-122 (Heap-based Buffer Overflow).

Critical Impact
A remote attacker can crash lib60870-based applications through a crafted IEC 60870-5-104 payload, disrupting availability of ICS/SCADA communication endpoints.

Affected Products

lib60870 v2.3.3
lib60870 v2.3.4, v2.3.5
lib60870 v2.3.6

Discovery Timeline

2026-06-29 - CVE-2026-51219 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-51219

Vulnerability Analysis

The defect resides in the HighPriorityASDUQueue_hasUnconfirmedIMessages function inside lib60870 v2, which manages the high-priority Application Service Data Unit (ASDU) queue used by IEC 60870-5-104 servers. When the function processes queue metadata driven by attacker-influenced input, it reads or writes outside the bounds of a heap allocation. The corruption path is reachable over the network without authentication, though user interaction on the target side is required to establish the vulnerable session state. Successful exploitation crashes the server process, terminating I-frame confirmation tracking and severing the control channel between master stations and outstations.

Root Cause

The root cause is missing or insufficient bounds validation on queue index or length values referenced by HighPriorityASDUQueue_hasUnconfirmedIMessages. Because the queue backing store is heap-allocated, the out-of-bounds access corrupts adjacent heap metadata or triggers a fault when unmapped memory is touched. This aligns with CWE-122, heap-based buffer overflow.

Attack Vector

An attacker with network reach to an IEC 60870-5-104 endpoint built on lib60870 v2.3.3–v2.3.6 sends a crafted protocol payload that drives the queue into an inconsistent state. The vector requires no privileges but requires user interaction to reach the vulnerable code path. The result is loss of availability of the ICS communication service. See the GitHub Issue #196 Discussion for reporter details and reproduction context.

Detection Methods for CVE-2026-51219

Indicators of Compromise

Unexpected termination or restart of processes linking lib60870 v2.3.3 through v2.3.6.
Core dumps or crash logs referencing HighPriorityASDUQueue_hasUnconfirmedIMessages in the stack trace.
Sudden loss of IEC 60870-5-104 session state with connected master stations or outstations.

Detection Strategies

Inventory ICS assets and identify binaries statically or dynamically linked against lib60870 versions in the vulnerable range.
Monitor TCP port 2404 (IEC 60870-5-104 default) for malformed ASDU frames and abnormal I-format message sequences.
Correlate process crash events on ICS gateways with inbound 60870-5-104 traffic bursts to surface DoS attempts.

Monitoring Recommendations

Forward host process telemetry and network flow data from ICS gateways into a centralized analytics platform for correlation.
Alert on repeated abnormal disconnects or protocol resets from a single source IP against IEC 60870-5-104 servers.
Track upstream releases in the GitHub Releases for lib60870 page to confirm patched versions are deployed.

How to Mitigate CVE-2026-51219

Immediate Actions Required

Identify all applications and firmware images that embed lib60870 v2.3.3 through v2.3.6.
Restrict network access to IEC 60870-5-104 endpoints so only authorized master stations can reach TCP port 2404.
Rebuild and redistribute dependent binaries once a fixed upstream version is available from the GitHub Repository for lib60870.

Patch Information

Monitor the vendor project for a fixed release addressing the heap buffer overflow in HighPriorityASDUQueue_hasUnconfirmedIMessages. Refer to the GitHub Issue #196 Discussion and the GitHub Releases for lib60870 for the authoritative fix version. Upgrade all downstream binaries after validating the fix in a staging environment.

Workarounds

Enforce network segmentation and firewall rules so IEC 60870-5-104 servers only accept connections from known master stations.
Terminate 60870-5-104 traffic at an industrial protocol-aware gateway that validates ASDU structure before forwarding.
Enable automatic process supervision (for example, systemd restart policies) to reduce downtime while patching is scheduled.

bash

# Configuration example: restrict IEC 60870-5-104 exposure with iptables
iptables -A INPUT -p tcp --dport 2404 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 2404 -j DROP