CVE-2026-48741 libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoS
Remote attackers can crash IEC 61850 servers by sending malformed MMS Read requests, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-48741?
CVE-2026-48741 is a high-severity vulnerability in mz-automation libiec61850, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValue_getElement call returns NULL, and the sub-array branch passes that value to MmsValue_isDeletable, causing a NULL pointer dereference. A remote MMS Read request can therefore crash servers whose data models contain arrays, while the single-element error path handles the same invalid index safely. This issue is fixed in version 1.6.2.
Which versions are affected by CVE-2026-48741?
How do I fix CVE-2026-48741?
No fix has been published for CVE-2026-48741 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-48741 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48741 exists.
Sources
Also known as GHSA-8mfr-hq64-9w33.