What’s Vulnerable › Vulnerabilities

CVE-2026-56758: MZ Automation libiec61850 Out-of-bounds Read

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-30 · updated 2026-10-23
• Weakness: CWE-125

Description

The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, an attacker controlled length value of zero or one may cause the parser to read past the end of a heap buffer.

Affected products

• mz-automation libiec61850: before 1.6.2 — fixed in 1.6.2

How to fix

Upgrade to a fixed version: mz-automation libiec61850 1.6.2. Check the vendor advisory for mitigations.

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-10.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10

Get alerted when CVE-2026-56758 or the next vulnerability affects your stack