CVE-2026-57446

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-57446
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57446.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-57446
Aliases
  • GHSA-cxgr-7v9h-fj9p
Published
2026-10-16T15:46:33Z
Modified
2026-10-30T07:21:55Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* handle
Details

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle but leaves the stale non-NULL value in a task marked MMS_FILE_UPLOAD_STATE_NOT_USED. If a later ObtainFile request reuses that task and destination creation fails, MMS_FILE_UPLOAD_STATE_SEND_OBTAIN_FILE_ERROR_DESTINATION cleanup closes the stale FILE object again. Servers with the MMS file service and ObtainFile enabled can therefore be crashed remotely by the success-then-failure request sequence. This issue is fixed in version 1.6.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-415",
        "CWE-664",
        "CWE-672"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57446.json"
}
References

Affected packages

Git / github.com/mz-automation/libiec61850

Affected ranges

Type
GIT
Repo
https://github.com/mz-automation/libiec61850
Events
Introduced
a13961110b8238d2d8ea577c1fb7592ba3017ad8
Fixed
f0f797bf955da763353f7081c892a1ff6b55e5a1
Fixed
d86b4a9c7a903641819235e1678b18901518f3cd
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "1.6.1"
                },
                {
                    "fixed": "1.6.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "d86b4a9c7a903641819235e1678b18901518f3cd"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v1.6.2",
            "range": [
                {
                    "fixed": "f0f797bf955da763353f7081c892a1ff6b55e5a1"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v1.*
v1.6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57446.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "312855759927274112080293458339887041405",
            "length": 2854
        },
        "id": "CVE-2026-57446-00916272",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mz-automation/libiec61850/commit/d86b4a9c7a903641819235e1678b18901518f3cd",
        "target": {
            "file": "src/mms/iso_mms/server/mms_server_connection.c",
            "function": "handleConfirmedResponsePdu"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "163736682457937949150125987832081640056",
                "281764961639966611161453138303875173770",
                "265220847518134335152288820281684355458",
                "281904535082822186931173034294057363491",
                "37661744291098775573053002097867596856",
                "234696898336044764949825208579681386502",
                "55462199349255656425534975418560217659",
                "150574349302915251633407286046135045825",
                "73342419229231582824411472452508746519",
                "156810145029563437762346810612555636379",
                "182502279302414866073912875573294239315",
                "303481780848682570219922651228941385703",
                "147048054219334403452775235819675115490",
                "263619652189803296468475399736350495185",
                "223626556732051896318806380606446061167",
                "102356119586536828704277550358611831651",
                "320984293140479221176576184651980882266",
                "246214066201919344844702959694087289334",
                "80110711729146763997961286276658265717",
                "244554201096094640976756264496319183782",
                "320984293140479221176576184651980882266",
                "166907176766653959570604837743170835841",
                "228775270919604004042748024759183562961",
                "167797830245475128952659537703563232786",
                "115326065894636019703791782216182121218",
                "273496078855863320004525217105510913286",
                "94659183310696492004313932529926684447",
                "132742415286162196523280704945097542715",
                "256382193227863251272193455720886768609",
                "223220102185013702620389126023640259847",
                "330795105526129338309755160111127801312",
                "113828067096356054114374118049825945090",
                "115326065894636019703791782216182121218",
                "169575294729154874516025233863263869126",
                "221818452602176929686085265691817197125",
                "120556666335925047419780864578414501759",
                "120888546651839853474155825489015852848",
                "136079907598937723479840877039911127569",
                "65740804996421970777580689142681605076",
                "168002706553608437939614340943287128735",
                "268039679466560578240976942453563469194",
                "175922586958736205867543478200608957064",
                "106230795965924326356036728669964426932",
                "69930379076413342199811036451456034516",
                "307786468515246491023690987735839666053",
                "247896927594582637496045106568759071221",
                "333276932571688386620330875470082001591",
                "206613817159443684102014182757379335016",
                "34088026298103682243946688838144746237",
                "231849609283759879573056247515538974606",
                "129479405481479392962156733739654519164",
                "138142852601543065985346486726244689802",
                "143918673225882004428471165159334671381",
                "13128191805236290450644399150712127954",
                "85987290797202286926270688586396580431",
                "244653427695175621905367149104142144442"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-57446-03ab2985",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mz-automation/libiec61850/commit/d86b4a9c7a903641819235e1678b18901518f3cd",
        "target": {
            "file": "src/mms/iso_mms/server/mms_file_service.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "193831222686297558576862420850922663367",
                "261618714715739326524018297539439772213",
                "5048633092484255562960874841395630322",
                "230822951843502358269377646385477769424"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-57446-0d76c227",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mz-automation/libiec61850/commit/d86b4a9c7a903641819235e1678b18901518f3cd",
        "target": {
            "file": "src/mms/iso_mms/server/mms_server_connection.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "88117835780922541715462949379054872684",
            "length": 4681
        },
        "id": "CVE-2026-57446-f37874c8",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mz-automation/libiec61850/commit/d86b4a9c7a903641819235e1678b18901518f3cd",
        "target": {
            "file": "src/mms/iso_mms/server/mms_file_service.c",
            "function": "mmsServer_fileUploadTask"
        }
    }
]
vanir_signatures_modified 
"2026-10-30T07:21:55Z"