libiec61850 flaw allows remote CPU loops in versions before 1.6.2

Systems using libiec61850 versions prior to 1.6.2 are affected by CVE-2026-68906. The open-source library implements IEC 61850 client and server protocols. The vulnerability is rated CVSS 8.7 HIGH. It allows an unauthenticated remote peer to send malformed data during association. This can cause an infinite CPU loop or a process abort. The issue is fixed in version 1.6.2.

How it unfolded

• The vulnerability exists in the parseUserInformation function within the acse.c source file.
• The code checks if length is zero before validating negative buffer positions returned by BerDecoder_decodeLength.
• This logic error causes the parser to swallow errors, read invalid memory, and reset parsing repeatedly.

Who is affected

Systems running libiec61850 versions older than 1.6.2 are vulnerable. The library supports MMS, GOOSE, Sampled Values, and R-Session protocols. According to the NVD record, the flaw is rated CVSS 8.7 HIGH. It involves weaknesses classified as CWE-125 and CWE-835. Any system using this library for communication faces risk. The vendor mz-automation maintains the library.

Our take on the response

The vendor has released version 1.6.2 to address the issue. The fix resolves the parsing logic error that allowed the infinite loop. This update eliminates the risk of remote denial-of-service attacks. Teams should verify their current versions against the release notes. Updating to the patched version removes the vulnerability from the environment.

Who needs to act first

Teams usually prioritize systems exposed to untrusted networks. Check whether production environments use affected library versions. Back up configurations before applying updates to ensure recovery options. Test the update in isolated environments to verify compatibility with existing workflows. Deploy the fix to critical assets first to reduce immediate exposure. Monitor logs for signs of malformed association requests during the rollout.

What to do and how to stay safe: libiec61850

• Identify all systems running libiec61850 versions older than 1.6.2.
• Apply the update to version 1.6.2 once the vendor provides it.
• Monitor network traffic for unusual association request patterns.
• Restrict access to systems using this library to trusted networks only.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-68906?

It is a high-severity vulnerability in libiec61850 that allows remote denial-of-service via malformed data.

Which versions are affected?

All versions of libiec61850 prior to 1.6.2 are affected by this flaw.

Is there a fix available?

Yes, the issue is fixed in version 1.6.2 of the library.