Malicious Read Requests Trigger Stack Buffer Overflow in MZ Automation libIEC61850 Library
A stack-based buffer overflow in the `libIEC61850` library can be triggered by a malicious Read Request. This vulnerability carries a CVSS score of 7.5 and could lead to memory corruption. If you are running industrial equipment using this specific library, prioritize reviewing your network traffic for unusual IEC 61850 communications.
Summary
A high-severity vulnerability has been identified in the libIEC61850 library developed by MZ Automation. The flaw is a stack-based buffer overflow that occurs when the software processes a Read Request. An attacker can exploit this weakness to cause memory corruption within the affected system.
The vulnerability, tracked as CVE-2026-50039, carries a CVSS score of 7.5. Because the attack vector is network-based and requires no user interaction or special privileges, it poses a significant risk to industrial control environments where this library is implemented.
Technical details
The vulnerability resides in how libIEC61850 handles incoming Read Requests. Specifically, the flaw involves a stack-based buffer overflow. When a specially crafted request is sent to the device, it can overwrite memory locations on the stack.
This type of memory corruption can lead to various outcomes, including service instability or unexpected software behavior. While the official description confirms the potential for memory corruption via these requests, specific details regarding the exact trigger mechanism within the code remain limited to the provided advisory data.
Why this matters for defenders
In industrial automation and control systems, protocol-specific vulnerabilities can disrupt critical processes. Because this flaw is triggered by a standard Read Request, an attacker who has gained network access to the target device can attempt to destabilize the system without needing any legitimate credentials.
The impact of memory corruption in an ICS environment often translates to a loss of availability or unpredictable control logic execution. Defenders should treat unauthenticated network requests targeting IEC 61850 services as high-risk events.
Defender guidance
Identify all assets within your industrial network that rely on the libIEC61850 library. This includes checking firmware inventories and software bills of materials (SBOMs) for components developed by MZ Automation.
Monitor network traffic for anomalous IEC 61850 Read Requests, particularly those originating from unexpected or unauthorized segments of the network. Implementing strict network segmentation can help limit the ability of an attacker to reach vulnerable endpoints.
Sources
