CVE-2026-68907

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtils_copyStringToBuffer while constructing an MMS_ASSOCIATION_SPECIFIC dataset reference. The helper treats uninitialized dataSetRef[130] storage as a source string, causing strlen to read beyond the stack buffer, and then copies those bytes into the caller-owned listName buffer. A remote defineNamedVariableList request can crash servers that have dynamic dataset service enabled and a dataset access handler installed; the advisory also observes caller stack corruption but establishes denial of service as the primary impact. This issue is fixed in version 1.6.2.

• CWE-125
• CWE-457
• CWE-628

• https://github.com/mz-automation/libiec61850/commit/062062daf4cb50c7aa76e01d6fb4d58fc9278a7d
• https://github.com/mz-automation/libiec61850/releases/tag/v1.6.2
• https://github.com/mz-automation/libiec61850/security/advisories/GHSA-7v2x-39mw-2979

Published

Oct 16, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-68899Wekan is open source kanban built with Meteor. Prior to 9.90…8.7
• CVE-2026-6890Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-68900Wekan is open source kanban built with Meteor. From 8.72 unt…7.6
• CVE-2026-68901Wekan is open source kanban built with Meteor. Prior to 10.3…6.5
• CVE-2026-68904node-opcua is an OPC UA implementation for TypeScript and No…7
• CVE-2026-68906libIEC61850 is an open-source implementation of IEC 61850 cl…8.7
• CVE-2026-68908libIEC61850 is an open-source implementation of IEC 61850 cl…5.3
• CVE-2026-6891Improper handling of symbolic links in the installer of My I…5.1
• CVE-2026-68911Nicotine+ is a graphical client for the Soulseek peer-to-pee…8.7
• CVE-2026-68914Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-68919GoCD is a continuous deliver server. From 13.3.0 until 26.1.…7
• CVE-2026-6892Improper handling of symbolic links in the installer of CUPS…5.1