CVE-2026-68906

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-68906
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68906.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-68906
Aliases
  • GHSA-f7xm-q62q-22cx
Published
2026-10-16T15:49:32Z
Modified
2026-10-28T11:17:19Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDU
Details

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path therefore swallows the error, reads buffer[-1], resets parsing to the beginning, and repeats the same malformed state. An unauthenticated remote peer can send a malformed AARE PDU during association to cause an infinite CPU loop under a normal allocator or a one-byte out-of-bounds read and process abort when the preceding byte is inaccessible. This issue is fixed in version 1.6.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-125",
        "CWE-835"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68906.json"
}
References

Affected packages

Git / github.com/mz-automation/libiec61850

Affected ranges

Type
GIT
Repo
https://github.com/mz-automation/libiec61850
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f0f797bf955da763353f7081c892a1ff6b55e5a1
Fixed
2edf2a12bf0ced6a2ac595862e3e873814983f7f
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.6.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "2edf2a12bf0ced6a2ac595862e3e873814983f7f"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v1.6.2",
            "range": [
                {
                    "fixed": "f0f797bf955da763353f7081c892a1ff6b55e5a1"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.1
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v1.4.0
v1.4.1
v1.6.0
v1.6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68906.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "227061984807293096731443597475595479052",
            "length": 970
        },
        "id": "CVE-2026-68906-0e844c66",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mz-automation/libiec61850/commit/2edf2a12bf0ced6a2ac595862e3e873814983f7f",
        "target": {
            "file": "src/mms/iso_acse/acse.c",
            "function": "parseUserInformation"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "339779001566978623473116640383580455515",
                "267957250715029985888352698971419948282",
                "73528225948832367757981218345185704572",
                "301356839736979920875337606590657394177",
                "295755133635154871198034023745516539416",
                "323711028678185453276296284000490738696",
                "201186627701391467361214339666339479165",
                "184587622210028428645698440934359887890",
                "204469127578891150999195881426375642988",
                "144176217324904760027768320099553564725"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-68906-5b53311f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mz-automation/libiec61850/commit/2edf2a12bf0ced6a2ac595862e3e873814983f7f",
        "target": {
            "file": "src/mms/iso_acse/acse.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:17:19Z"