Answer in brief
CVE-2026-68906 records a High severity (CVSS 8.7) vulnerability in libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDU. The current sources do not mark it as known exploited. The current feed maps mz-automation/libiec61850 (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps mz-automation/libiec61850 (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| mz-automation/libiec61850generic | <1.6.2 | 1.6.2 |
Published upstream
Oct 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 16, 2026
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path therefore swallows the error, reads buffer[-1], resets parsing to the beginning, and repeats the same malformed state. An unauthenticated remote peer can send a malformed AARE PDU during association to cause an infinite CPU loop under a normal allocator or a one-byte out-of-bounds read and process abort when the preceding byte is inaccessible. This issue is fixed in version 1.6.2.
Quoted source text, attributed separately from HOL analysis.