CVE-2026-63550 MZ Automation GmbH CVE debrief

Who should care

Organizations using MMS services, particularly those in industrial control systems, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing MMS session configurations, monitoring for unusual activity, and applying patches or updates to MMS BER decoder implementations. Security teams should prioritize patching to prevent potential denial-of-service attacks. Affected operators and platforms should verify their exposure and review decoder implementations for similar flaws.

Technical summary

The MMS BER decoder contains a boundary-handling flaw in confirmed-request messages. When a crafted BER-encoded element is received over an established MMS session (TCP port 102), the decoder may advance its internal read position incorrectly, leading to a heap out-of-bounds read and denial-of-service. Affected systems require patching to prevent potential attacks. Organizations should review MMS session configurations and apply patches or updates to MMS BER decoder implementations.

Defensive priority

Organizations using MMS services should prioritize patching to prevent potential denial-of-service attacks.

Recommended defensive actions

• Apply patches or updates to MMS BER decoder implementations
• Review and update MMS session configurations to limit exposure
• Monitor MMS services for unusual activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE description indicates a boundary-handling flaw in the MMS BER decoder, leading to a heap out-of-bounds read and potential denial-of-service. The NVD entry is currently 7.1 HIGH. Organizations should verify their exposure and review decoder implementations for similar flaws. Defensive measures include reviewing MMS session configurations and monitoring for unusual activity.

Official resources