MZ Automation fixes severe flaws in libIEC61850
MZ Automation has patched four vulnerabilities in its libIEC61850 library that could let unauthenticated attackers crash power-grid services or run code on affected equipment.
Source: CISA · July 24, 2026 at 10:59 PM · AI-assisted report
Single-source
KUALA LUMPUR, 25 JULY 2026 —
MZ Automation has patched four vulnerabilities in its libIEC61850 library that could let unauthenticated attackers crash power-grid services or run code on affected equipment.
Market Impact
The flaws—stack-based buffer overflow, heap-based buffer overflow, improper handling of malformed structures and NULL pointer dereference—carry CVSS scores from 6.5 to 9.2. They affect all versions from 1.0.0 onwards and sit in core IEC 61850 protocol handling used by protection relays, substation controllers and other grid devices.
According to a CISA advisory issued July 23 2026, exploitation could disrupt visibility, control or protection functions in critical manufacturing, energy and transportation systems deployed worldwide. Germany-based MZ Automation recommends users update to the latest build at https://github.com/mz-automation/libiec61850.
The vulnerabilities map to common weakness enumerations CWE-121, CWE-122, CWE-228 and CWE-476. A heap-based buffer overflow in the MMS Initiate request path (CVE-2026-49035) can lead to remote code execution when address space layout randomisation is off; memory corruption or denial of service can still occur when ASLR is enabled. A NULL pointer dereference in the L2 GOOSE/R-GOOSE parser (CVE-2026-50103) crashes subscribing applications that accept malformed TLV values.
A second NULL pointer dereference in the MMS Write Named Variable List handler (CVE-2026-50032) allows servers to be taken offline by sending a WriteRequest with an empty listOfData field.
CISA advises operators to isolate control networks behind firewalls, avoid internet exposure and use VPNs with current patches for remote access. The agency notes no public exploitation has been reported so far.