CVE-2026-19206

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-19206

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19206.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-19206

Published

2026-08-07T13:45:12Z

Modified

2026-08-14T08:08:28Z

Severity

1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

MZ Automation libiec61850 ASDU Element sv_subscriber.c SVReceiver_stopThreadless heap-based overflow

Details

A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiver_stopThreadless of the file src/sampled_values/sv_subscriber.c of the component ASDU Element Handler. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.2 is able to mitigate this issue. The patch is named a96bd674e0238276dd1387d31d52e55229d0771e. The affected component should be upgraded.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-119",
        "CWE-122"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19206.json"
}

References

Affected packages

Git / github.com/mz-automation/libiec61850

Affected ranges

Type

GIT

Repo

https://github.com/mz-automation/libiec61850

Events

Introduced

519b0208cc79d1af09d5ca40fb9ad1fd93822e93

Fixed

a96bd674e0238276dd1387d31d52e55229d0771e

Fixed

f0f797bf955da763353f7081c892a1ff6b55e5a1

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "1.6.0"
        },
        {
            "last_affected": "1.6.0"
        },
        {
            "introduced": "1.6.1"
        },
        {
            "last_affected": "1.6.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.6.0

1.6.1

v1.*

v1.6.0

v1.6.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19206.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "287707845104257276366322621640269011399",
            "length": 2504
        },
        "id": "CVE-2026-19206-c94859b7",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mz-automation/libiec61850/commit/a96bd674e0238276dd1387d31d52e55229d0771e",
        "target": {
            "file": "src/sampled_values/sv_subscriber.c",
            "function": "parseASDU"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "268632004596438426002343833648465355151",
                "130097210590210381030875770671628751382",
                "334829509155942514176359171662595590671",
                "214679206892211371946223050092592169179",
                "54824532154602430443197707048683395132",
                "85822701904347437195423268044744619763",
                "80557409898652543173677150579492973064",
                "129628088716647113888950820840840429130",
                "325466582867867828578507932221617569508",
                "193748264486259165142689835245589685747",
                "98986632970999788347014656660950765350",
                "185951595673802309514483735889213778975",
                "202496183038545687843255988475975064293",
                "160924185332465156389495902436615500502",
                "322602631225617360681783311520705965640",
                "96685372135584430520076505233962234507",
                "252645186036530353647865437816106672621",
                "212279012119288225582654689533432335750",
                "190523808080514460833787449186556629862",
                "19671775485942304167847553384017662359",
                "333329614202522979856201245677291806889",
                "331548612456681865685238339051160066903",
                "219462849491069843652509665970563864559",
                "97651502318793607379525277580564277668",
                "12718910528567709442208095573756247482",
                "15679507375181402363319328321735659244",
                "142173489839569779478240806649842414401",
                "277846816438710800287472329055120122977",
                "174905398577306296586055387529204962276",
                "147264058269944549179920851459869874938",
                "187512393129813268262916508083279744369"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-19206-fe05c463",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mz-automation/libiec61850/commit/a96bd674e0238276dd1387d31d52e55229d0771e",
        "target": {
            "file": "src/sampled_values/sv_subscriber.c"
        }
    }
]

vanir_signatures_modified

"2026-08-14T08:08:28Z"