CVE-2026-68906 libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDU
An unauthenticated remote attacker can cause a denial of service via infinite loop or crash by sending a malformed AARE PDU to libIEC61850.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-68906?
CVE-2026-68906 is a high-severity denial of service vulnerability in mz-automation libiec61850, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path therefore swallows the error, reads buffer[-1], resets parsing to the beginning, and repeats the same malformed state. An unauthenticated remote peer can send a malformed AARE PDU during association to cause an infinite CPU loop under a normal allocator or a one-byte out-of-bounds read and process abort when the preceding byte is inaccessible. This issue is fixed in version 1.6.2.
Which versions are affected by CVE-2026-68906?
How do I fix CVE-2026-68906?
No fix has been published for CVE-2026-68906 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-68906 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-68906 exists.
Sources
Also known as GHSA-f7xm-q62q-22cx.