CVE-2026-48741

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48741
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48741.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48741
Aliases
  • GHSA-8mfr-hq64-9w33
Published
2026-10-16T15:45:32Z
Modified
2026-10-28T10:51:48Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoS
Details

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValue_getElement call returns NULL, and the sub-array branch passes that value to MmsValue_isDeletable, causing a NULL pointer dereference. A remote MMS Read request can therefore crash servers whose data models contain arrays, while the single-element error path handles the same invalid index safely. This issue is fixed in version 1.6.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-129",
        "CWE-252",
        "CWE-476",
        "CWE-754"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48741.json"
}
References

Affected packages

Git / github.com/mz-automation/libiec61850

Affected ranges

Type
GIT
Repo
https://github.com/mz-automation/libiec61850
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f0f797bf955da763353f7081c892a1ff6b55e5a1
Fixed
7c15310405def00cac628ebde4ce1404bfb8a411
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.6.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "7c15310405def00cac628ebde4ce1404bfb8a411"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v1.6.2",
            "range": [
                {
                    "fixed": "f0f797bf955da763353f7081c892a1ff6b55e5a1"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.1
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v1.4.0
v1.4.1
v1.6.0
v1.6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48741.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "44633973656885522923648802235900282851",
            "length": 1199
        },
        "id": "CVE-2026-48741-980afba8",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mz-automation/libiec61850/commit/7c15310405def00cac628ebde4ce1404bfb8a411",
        "target": {
            "file": "src/mms/iso_mms/server/mms_read_service.c",
            "function": "addNamedVariableToNamedVariableListResultList"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "190468146190064150161509629152827613788",
                "201979851604679936407241138763323014601",
                "217585093075974955576323958803390967384",
                "30256112852566818913636892102980493201",
                "136175594241603663647174932172186932761",
                "312475085375351587200760760459271226115",
                "9851547146935951680275894251922075564",
                "211183832291854501646804797592544785497",
                "7657670924645221474112494114825140684",
                "265053611940472030737778152274883140844",
                "309281413482117716200718119609579322764",
                "247590527091588682768956879654608404193",
                "120649238928631443569528973637050349051",
                "179430716529544515450706889211669612868",
                "208978778300449392481563429004580015397",
                "230343367285205951354322281970957603728",
                "171677036341217648020039603522840860466",
                "263823341063965819866708905192473353727",
                "261422065152919676268256957534690061433",
                "326024897409160866179725231269728901715",
                "311664004973094751110085469659673938552",
                "108429964177232531502412486110881609187",
                "294782054447209155140035043094129794644",
                "104497382248510112555953503738548060774",
                "237593899613125303679527128173195403877",
                "89857555660031563367576604276708339935",
                "140658278538831029872530094565438620587"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-48741-9b15056a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mz-automation/libiec61850/commit/7c15310405def00cac628ebde4ce1404bfb8a411",
        "target": {
            "file": "src/mms/iso_mms/server/mms_read_service.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "150299470569160750946485493464288961305",
            "length": 1221
        },
        "id": "CVE-2026-48741-d22c057b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mz-automation/libiec61850/commit/7c15310405def00cac628ebde4ce1404bfb8a411",
        "target": {
            "file": "src/mms/iso_mms/server/mms_read_service.c",
            "function": "alternateArrayAccess"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T10:51:48Z"