CVE-2026-48503 mz-automation CVE debrief

Who should care

Defenders responsible for systems using libIEC61850 should assess exposure and prioritize upgrading to version 1.6.2 or later. They should also review and limit access to the MMS file service to trusted clients only, and monitor for any suspicious activity related to the MMS file service. Additionally, defenders should verify if libIEC61850 versions prior to 1.6.2 are in use and upgrade to 1.6.2 or later.

Why it matters

CVE-2026-48503 is a remote information disclosure vulnerability in libIEC61850's MMS file service. Defenders should verify exposure, prioritize upgrading to version 1.6.2 or later, and limit access to trusted clients only.

• Potential disclosure of prior response data and protocol fragments to unauthenticated remote clients.
• Possible exposure of sensitive information through the MMS file service.

Technical summary

The MMS file service in libIEC61850 accepts an out-of-range initialPosition in fileOpen and stores it in the file-read state. The fileRead path then subtracts the larger read position from the file size using unsigned arithmetic and fails to limit the response to the actual FileSystem_readFile return value. This can lead to stale bytes from the reused connection buffer being included in the response, disclosing prior response data and protocol fragments to an unauthenticated remote client. The vulnerability is fixed in version 1.6.2.

Defensive priority

Defenders should prioritize verifying exposure and upgrading to version 1.6.2 or later.

Recommended defensive actions

• Verify if libIEC61850 versions prior to 1.6.2 are in use and upgrade to 1.6.2 or later.
• Review and limit access to the MMS file service to trusted clients only.
• Monitor for any suspicious activity related to the MMS file service.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and the fix in version 1.6.2. The vulnerability is caused by the MMS file service in libIEC61850 accepting an out-of-range initialPosition in fileOpen and storing it in the file-read state. The fileRead path then subtracts the larger read position from the file size using unsigned arithmetic and fails to limit the response to the actual FileSystem_readFile return value. This can lead to stale bytes from the reused connection buffer being included in the

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.