CVE-2026-57446 libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* handle
Remote attackers can crash IEC 61850 servers by triggering a double free in the MMS ObtainFile task reuse logic when file services are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-57446?
CVE-2026-57446 is a medium-severity use after free vulnerability in mz-automation libiec61850, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle but leaves the stale non-NULL value in a task marked MMS_FILE_UPLOAD_STATE_NOT_USED. If a later ObtainFile request reuses that task and destination creation fails, MMS_FILE_UPLOAD_STATE_SEND_OBTAIN_FILE_ERROR_DESTINATION cleanup closes the stale FILE object again. Servers with the MMS file service and ObtainFile enabled can therefore be crashed remotely by the success-then-failure request sequence. This issue is fixed in version 1.6.2.
Which versions are affected by CVE-2026-57446?
How do I fix CVE-2026-57446?
No fix has been published for CVE-2026-57446 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-57446 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-57446 exists.
Sources
Also known as GHSA-cxgr-7v9h-fj9p.